CVE-2025-66219

Katalog CVE

CVSS 9.8 · Critical EPSS 2,7%

Kerentanan Improper Neutralization of Special Elements used in a Command ('Command Injection') pada dontkry willitmerge. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

willitmerge is a command line tool to check if pull requests are mergeable. In versions 0.2.1 and prior, there is a command Injection vulnerability in willitmerge. The vulnerability manifests in this package due to the use of insecure child process execution API (exec) to which it concatenates user input, whether provided to the command-line flag, or is in user control in the target repository. At time of publication, no known fix is public.

Rincian

Terbit di NVD

29 November 2025

Terakhir diubah

7 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

EPSS (30 hari)

2,7% peluang dieksploitasi; lebih tinggi dari 85,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/shama/willitmerge/security/advisories/GHSA-j9wj-m24m-7jj6 exploit · advisory vendor
• https://github.com/shama/willitmerge/blob/2fe91d05191fb05ac6da685828d109a3a5885028/lib/willitmerge.js#L189-L19... product