A locally exploitable OS command injection flaw is present in the danger‑js command line interface, specifically within the diffForFile function in the localGetFileAtSHA module. An attacker who can influence the File argument of this function can cause arbitrary operating‑system commands to be executed with the privileges of the running CLI process. The vulnerability maps to CWE-77 and CWE-78. Among the consequences are the potential compromise of the host system, unauthorized access to sensitive data, and disruption of availability for services that rely on the CLI.

All installations of danger‑js up to version 13.0.7 are affected. Updating to version 13.0.8 or later resolves the issue.

The CVSS score of 4.8 indicates moderate severity, and the EPSS score of < 1% indicates a low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Because exploitation requires local access to the CLI, the attack vector is inferred to be local. An attacker must be able to execute or influence the diffForFile call; therefore, restricting local usage or ensuring the File parameter is not derived from untrusted input reduces the risk.