{"id":"EUVD-2025-199766","revision":"11161a7129d34d20b53b2ce7a45d3ea9","records":[{"revision":"11161a7129d34d20b53b2ce7a45d3ea9","observedAt":"2026-11-01T01:14:48.806+00:00","statement":{"source":"euvd","id":"EUVD-2025-199766","aliases":["CVE-2025-66219","GHSA-j9wj-m24m-7jj6"],"title":"willitmerge is a command line tool to check if pull requests are mergeable. In versions 0.2.1 and prior, there is a command Injection vulnerability in willitmerge. The vulnerability manifests in this package due to the use of insecure child…","description":"willitmerge is a command line tool to check if pull requests are mergeable. In versions 0.2.1 and prior, there is a command Injection vulnerability in willitmerge. The vulnerability manifests in this package due to the use of insecure child process execution API (exec) to which it concatenates user input, whether provided to the command-line flag, or is in user control in the target repository. At time of publication, no known fix is public.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","score":6.9,"severity":null}],"references":["https://github.com/shama/willitmerge/security/advisories/GHSA-j9wj-m24m-7jj6","https://github.com/shama/willitmerge/blob/2fe91d05191fb05ac6da685828d109a3a5885028/lib/willitmerge.js#L189-L197"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-199766","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Nov 29, 2025, 1:34:33 AM","dateUpdated":"Dec 1, 2025, 7:15:03 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-199766","identifiers":["EUVD-2025-199766","CVE-2025-66219","GHSA-j9wj-m24m-7jj6"]},"retained":false,"historicalAffected":[]}],"coverage":[]}