willitmerge has a command Injection vulnerability

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2025-66219 · Microsoft / collected KEV context

EUVD-2025-199766

GHSA-j9wj-m24m-7jj6

cve-program · CVE-2025-66219

• https://github.com/shama/willitmerge/security/advisories/GHSA-j9wj-m24m-7jj6
• https://github.com/shama/willitmerge/blob/2fe91d05191fb05ac6da685828d109a3a5885028/lib/willitmerge.js#L189-L197

euvd · EUVD-2025-199766

• https://github.com/shama/willitmerge/security/advisories/GHSA-j9wj-m24m-7jj6
• https://github.com/shama/willitmerge/blob/2fe91d05191fb05ac6da685828d109a3a5885028/lib/willitmerge.js#L189-L197

nvd · CVE-2025-66219

• https://github.com/shama/willitmerge/blob/2fe91d05191fb05ac6da685828d109a3a5885028/lib/willitmerge.js#L189-L197
• https://github.com/shama/willitmerge/security/advisories/GHSA-j9wj-m24m-7jj6

osv · GHSA-j9wj-m24m-7jj6

• https://github.com/shama/willitmerge/security/advisories/GHSA-j9wj-m24m-7jj6
• https://nvd.nist.gov/vuln/detail/CVE-2025-66219
• https://github.com/shama/willitmerge
• https://github.com/shama/willitmerge/blob/2fe91d05191fb05ac6da685828d109a3a5885028/lib/willitmerge.js#L189-L197

No related operational record is retained in the current change model.