-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| willitmerge | npm | <= 0.2.1 |
Miggo AIRoot Cause AnalysisThe command injection vulnerability in willitmerge is caused by the insecure construction and execution of shell commands. The analysis of lib/willitmerge.js reveals two key functions involved in the vulnerability.
First, the willitmerge.testIssue function assembles an array of git commands. It does this by concatenating strings with data that can be controlled by a user, such as the --remote command-line option (that.options.remote) and metadata from a GitHub pull request, including branch names (iss.base.ref, iss.head.ref). An attacker can craft a malicious branch name or a --remote value containing shell metacharacters (e.g., ;, &&, ||) to inject arbitrary commands.
Second, the execSeries function receives this array of command strings and executes each one sequentially using child_process.exec. The exec function spawns a shell and executes the command within it, making it a well-known sink for command injection vulnerabilities when used with untrusted input. Therefore, execSeries is the function that directly triggers the execution of the injected commands.
During exploitation, a runtime profile would show willitmerge.testIssue being called to prepare the malicious commands, followed by a call to execSeries, which would then invoke the vulnerable exec call.
willitmerge.testIssuelib/willitmerge.js
execSerieslib/willitmerge.js
Ongoing coverage of React2Shell