Executive brief
willitmerge is a command-line tool designed to check whether pull requests can be safely merged in Git repositories. A command injection vulnerability in the tool allows attackers to execute arbitrary system commands by injecting malicious input through command-line flags or by creating branches with specially crafted names. An attacker with control over a repository or its branches could gain remote code execution on systems running the tool.
Technical details
The vulnerability is a command injection (CWE-77) caused by unsafe use of the Node.js child_process exec() function concatenated with unsanitized user input. Vulnerable code in lib/willitmerge.js (lines 189–197) constructs Git commands by directly concatenating user-controlled parameters such as repository remote URLs and branch names without proper escaping. An attacker can inject shell metacharacters (e.g., semicolons, ampersands) through the --remote flag or via malicious branch names to execute arbitrary commands. The attack vector is network-accessible, requires no authentication, and can be triggered by repository collaborators or via crafted pull request metadata. No patches have been released as of the advisory date.
Affected products
- willitmerge willitmerge 0.2.1 and earlier
Timeline
- 2025-11-26: disclosed
- 2025-11-26: advisory: GHSA-j9wj-m24m-7jj6 published