CVE-2026-110634

git-diff before 2.0.7 OS Command Injection via gitDiff Input Strings

Published Oct 14, 2026 CVSS 4.0 · 9.3 Critical EPSS 2.3% KEV · Not listed

Description

git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed document string can embed $(cmd) or backtick substitutions that shelljs.exec evaluates, running commands with Node.js process privileges.

Analysis

Technical impact

git-diff before version 2.0.7 contains an OS command injection flaw that allows an attacker who can supply a diff string to embed shell metacharacters such as $(cmd) or backticks. The API calls shelljs.exec to evaluate those characters, causing arbitrary shell commands to run with the Node.js process privileges. This satisfies the CWE‑78 definition of an operating‑system command injection.

Affected Systems

The vulnerability affects the danday74:git-diff project, specifically the git‑diff‑apply component. Any installation of git-diff with a version older than 2.0.7 is impacted. Upgrading to 2.0.7 or later removes the flaw.

Risk and Exploitability

The CVSS score of 9.3 indicates critical severity. The EPSS score of 2% shows a moderate probability of exploitation, and the issue is not listed in CISA’s KEV catalog. The likely attack vector requires an attacker to supply a crafted diff string to the gitDiff API; successful exploitation would lead to arbitrary code execution with the privileges of the Node.js process.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

danday74

git-diff

unaffected

Version	Status	Constraints
`0`	affected	< 2.0.7

No data.

Vendor Product Versions

Danday74

Git-diff

Version	Status	Scheme	Platform
`[0,2.0.7)`	affected	semver	—

Git-diff-apply Project

Git-diff-apply

Version	Status	Scheme	Platform
`[0,*]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade git-diff to version 2.0.7 or newer.
Sanitize or validate any diff strings before passing them to the gitDiff API to strip shell metacharacters such as $(…) or backticks.
Run git-diff in a least‑privileged or sandboxed environment so that any injected commands run with limited privileges.

Generated by OpenCVE AI on October 15, 2026 at 21:01 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-6wfj-92cw-88vg	git-diff: OS command injection vulnerability via crafted strings to the gitDiff API

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 2.3% (2.348% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://github.com/danday74/git-diff
https://github.com/danday74/git-diff/blob/a85a649badc4c6bba991e87e82382b7d3cdd6634/js/gitDiffReal/generateDiff/index.js#L26-L30
https://github.com/danday74/git-diff/commit/bfd727b6cf1daa671c3528d1d681f55b70e8fb19
https://github.com/danday74/git-diff/pull/16
https://www.vulncheck.com/advisories/git-diff-before-2.0.7-os-command-injection-via-gitdiff-input-strings

History

Nov 10, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Oct 27, 2026 4:30 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Danday74 Danday74 git-diff
Vendors & Products		Danday74 Danday74 git-diff

Oct 14, 2026 2:30 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed document string can embed $(cmd) or backtick substitutions that shelljs.exec evaluates, running commands with Node.js process privileges.
Title		git-diff before 2.0.7 OS Command Injection via gitDiff Input Strings
First Time appeared		Git-diff-apply Project Git-diff-apply Project git-diff-apply
Weaknesses		CWE-78
CPEs		cpe:2.3:a:git-diff-apply_project:git-diff-apply::::::::
Vendors & Products		Git-diff-apply Project Git-diff-apply Project git-diff-apply
References		https://github.com/danday74/git-diff https://github.com/danday74/git-diff/blob/a85a649badc4c6bba991e87e82382b7d3cdd6634/js/gitDiffReal/generateDiff/index.js#L26-L30 https://github.com/danday74/git-diff/commit/bfd727b6cf1daa671c3528d1d681f55b70e8fb19 https://github.com/danday74/git-diff/pull/16 https://www.vulncheck.com/advisories/git-diff-before-2.0.7-os-command-injection-via-gitdiff-input-strings
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`