CVE-2025-66219 is a command injection in willitmerge, an npm command line tool that checks whether pull requests are mergeable. Versions 0.2.1 and earlier build shell commands from user input. At publication no fix is public. The record scores it 9.8 critical; the advisory says Moderate.
What's affected
- Package: willitmerge on npm.
- Affected: 0.2.1 and prior (the advisory lists affected versions as all).
- Fixed: none. The record says no known fix was public at publication, and the advisory lists patched versions as None.
Severity differs by source. The record gives CVSS 9.8 (critical). The GitHub advisory labels it Moderate. Both agree that no patch exists, which matters more than the label.
How to check if you're exposed
Search for the package in your projects and on build machines.
npm ls willitmerge
npm ls -g willitmerge
grep -r "willitmerge" package.json package-lock.json 2>/dev/null
Also search CI configuration and scripts for calls to the willitmerge command. If it only runs on a developer laptop against repositories you own, exposure is lower than if it runs in automation against branches from outside contributors.
What to do now
- Stop using willitmerge. With no fix public, removal is the safe option. Replace it with a maintained tool or with the hosting platform's own mergeability checks.
- Remove it from package.json, lock files and any global install, and from CI images.
- If you must keep it for now, do not run it on repositories where untrusted people can create branches, and do not pass untrusted values to its flags.
- Run any such tool in a disposable sandbox with no secrets mounted.
- Check the rest of your tree for abandoned packages. Paste your manifests into the free in-browser scan at gold.safeguard.sh/scan to see which of your dependencies carry this CVE, and use reachability analysis to separate the services that actually call the affected code from the ones that only list the package.
Why it matters
The advisory explains that the tool uses an insecure child process API, exec, and concatenates user input into git commands. Input comes both from command line flags and from the target repository, where branch names are controlled by collaborators. That is the textbook shape of CWE-77: special characters in data are treated as shell syntax.
The broader risk is trust in developer tooling. A small helper that shells out with string concatenation can run attacker text on a developer machine or a CI runner, and those places hold tokens and signing keys. The record does not show exploitation in the wild, and it is not on CISA KEV.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a patched version?
No. At the time of the record and the advisory, no fix was public, so remove the tool or contain it.
Why is branch naming relevant?
The advisory says branch names in the target repository are under the control of collaborators and are placed in git commands without safe handling.
Sources
Last reviewed: 18 October 2026.
