-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| willitmerge | npm | <= 0.2.1 |
Miggo AIRoot Cause AnalysisThe vulnerability exists because the willitmerge package unsafely constructs shell commands using user-controllable input and executes them via child_process.exec. The analysis of lib/willitmerge.js reveals two primary attack vectors.
First, the willitmerge.findRemote function takes the --remote command-line argument and directly concatenates it into a git remote show -n command. As demonstrated in the proof-of-concept, an attacker can inject arbitrary commands by appending them to the remote URL, separated by a semicolon.
Second, the willitmerge.testIssue function constructs several git commands using metadata from a GitHub pull request, such as branch names (iss.base.ref, iss.head.ref). An attacker can create a pull request with a maliciously crafted branch name containing shell commands. When willitmerge processes this pull request, the commands are executed on the host system.
In both cases, the commands are executed by the execSeries helper function, which is a simple wrapper around the insecure exec function. Therefore, willitmerge.findRemote, willitmerge.testIssue, and execSeries are the key functions that would appear in a runtime profile during exploitation.
willitmerge.findRemotelib/willitmerge.js
willitmerge.testIssuelib/willitmerge.js
execSerieslib/willitmerge.js