willitmerge has a command Injection vulnerability

Vulnerability

Overview

willitmerge is a Node.js command-line tool that checks if GitHub pull requests are mergeable. In versions 0.2.1 and prior, it uses the insecure child_process.exec() API, directly concatenating user-supplied input into shell commands. This input can come from command-line flags such as --remote or from repository metadata (e.g., branch names, remote URLs) that are under user control [1][3].

Exploitation

Vector

An attacker can exploit this vulnerability by providing malicious data to the --remote flag or by creating a repository with crafted branch names. For example, a proof-of-concept runs willitmerge --verbose --remote "https://github.com/lirantal/npq.git; touch /tmp/hel", which executes the injected touch command on the host [4]. Similarly, a malicious branch name like ;{echo,hello,world}>/tmp/c can be used because the tool concatenates such names directly into git commands without sanitization [3].

Impact

Successful exploitation allows arbitrary command execution with the privileges of the user running willitmerge. This can lead to unauthorized file access, persistence, lateral movement, or full system compromise, depending on the environment [1][4].

Mitigation

Status

As of the publication date, no fix is available for this vulnerability [1][4]. Users are advised to avoid using willitmerge with untrusted input or in automated pipelines where the tool processes repositories from unverified sources. No official workaround or patch has been released.