Description
git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed document string can embed $(cmd) or backtick substitutions that shelljs.exec evaluates, running commands with Node.js process privileges.
Published: 2026-10-14
Score: 9.3 Critical
EPSS: 2.3% Low
KEV: No
Impact: OS Command Injection
Action: Immediate Patch
AI Analysis

Impact

git-diff before version 2.0.7 contains an OS command injection flaw that allows an attacker who can supply a diff string to embed shell metacharacters such as $(cmd) or backticks. The API calls shelljs.exec to evaluate those characters, causing arbitrary shell commands to run with the Node.js process privileges. This satisfies the CWE‑78 definition of an operating‑system command injection.

Affected Systems

The vulnerability affects the danday74:git-diff project, specifically the git‑diff‑apply component. Any installation of git-diff with a version older than 2.0.7 is impacted. Upgrading to 2.0.7 or later removes the flaw.

Risk and Exploitability

The CVSS score of 9.3 indicates critical severity. The EPSS score of 2% shows a moderate probability of exploitation, and the issue is not listed in CISA’s KEV catalog. The likely attack vector requires an attacker to supply a crafted diff string to the gitDiff API; successful exploitation would lead to arbitrary code execution with the privileges of the Node.js process.

Generated by OpenCVE AI on October 15, 2026 at 21:01 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade git-diff to version 2.0.7 or newer.
  • Sanitize or validate any diff strings before passing them to the gitDiff API to strip shell metacharacters such as $(…) or backticks.
  • Run git-diff in a least‑privileged or sandboxed environment so that any injected commands run with limited privileges.

Generated by OpenCVE AI on October 15, 2026 at 21:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Description git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed document string can embed $(cmd) or backtick substitutions that shelljs.exec evaluates, running commands with Node.js process privileges.
Title git-diff before 2.0.7 OS Command Injection via gitDiff Input Strings
First Time appeared Git-diff-apply Project
Git-diff-apply Project git-diff-apply
Weaknesses CWE-78
CPEs cpe:2.3:a:git-diff-apply_project:git-diff-apply:*:*:*:*:*:*:*:*
Vendors & Products Git-diff-apply Project
Git-diff-apply Project git-diff-apply
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Git-diff-apply Project Git-diff-apply
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-14T17:34:01.053Z

Reserved: 2026-10-14T13:07:31.423Z

Link: CVE-2026-110634

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-14T15:17:16.417

Modified: 2026-10-16T19:18:44.867

Link: CVE-2026-110634

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-15T21:15:14Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')