CVE-2026-110634: git-diff before 2.0.7 OS Command Injection via gitDiff Input Strings
git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed document string can embed $(cmd) or backtick substitutions that shelljs.exec evaluates, running commands with Node.js process privileges.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using git-diff before 2.0.7 are exposed if an attacker can control either document string passed to the gitDiff API. The injected command runs with the privileges of the Node.js process.
Does exploitation require authentication or user interaction?
No. The provided severity vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction.
What input patterns can trigger command execution?
Crafted diffed document strings containing shell command substitutions such as $(cmd) or backtick substitutions can be evaluated by shelljs.exec.