Critical · published November 29, 2025
⚠️ A crafty command injection vulnerability lurks in willitmerge, allowing attackers to run arbitrary commands on your system! Think of it like a restaurant that takes your order and lets you add anything to it without checking if it’s safe — a recipe for disaster! 🍽️ If someone inputs a dangerous ingredient, it could ruin the dish completely. An attacker could exploit this flaw to execute harmful commands on your machine, potentially compromising sensitive data or taking control of your environment. While it’s not known to be actively exploited, the risk of misuse remains quite serious!
Think of it like a restaurant that takes your order and lets you add anything to it without checking if it’s safe — a recipe for disaster! 🍽️ If someone inputs a dangerous ingredient, it could ruin the dish completely. The vulnerability stems from willitmerge using an insecure child process execution API (exec) that concatenates user input. This means any command a user provides can be executed without proper validation, leading to potential command injection attacks.
An attacker could exploit this flaw to execute harmful commands on your machine, potentially compromising sensitive data or taking control of your environment. While it’s not known to be actively exploited, the risk of misuse remains quite serious! Until a patch is released, avoid using versions 0.2.1 and prior of willitmerge. Implement input validation to sanitize user inputs, and monitor any usage of this tool in your environment. Stay tuned for updates from maintainers! You've got this! By being proactive and vigilant, you can keep your environment secure. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| dontkry/willitmerge | ≤ 0.2.1 | — |