CVE-2025-66219 willitmerge has a command Injection vulnerability
An attacker can execute arbitrary commands via insecure child process execution in the willitmerge CLI tool.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-66219?
CVE-2025-66219 is a medium-severity command injection vulnerability in shama willitmerge, published on 29 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
willitmerge is a command line tool to check if pull requests are mergeable. In versions 0.2.1 and prior, there is a command Injection vulnerability in willitmerge. The vulnerability manifests in this package due to the use of insecure child process execution API (exec) to which it concatenates user input, whether provided to the command-line flag, or is in user control in the target repository. At time of publication, no known fix is public.
Weakness: CWE-77
Which versions are affected by CVE-2025-66219?
2 open source packages ship an affected version, including willitmerge. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
willitmerge npm | All versions to 0.2.1 | None |
willitmerge npm | All versions to 0.2.1 | None |
Products include Dontkry Willitmerge.
How do I fix CVE-2025-66219?
No fix has been published for CVE-2025-66219 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-66219 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-66219 exists.
Sources
Also known as GHSA-j9wj-m24m-7jj6.