git-diff: OS command injection via gitDiff input strings
Summary
The npm package git-diff before version 2.0.7 allows OS command injection through the gitDiff API. An attacker who controls the document strings passed to the function can embed shell command substitutions, which are evaluated by shelljs.exec and run with the privileges of the Node.js process. The record does not require privileges or user interaction, so exposure depends on whether an application passes untrusted text into the library.
Affected
- git-diff versions before 2.0.7 (Mend lists >=1.0.0 <2.0.7; treat all versions before 2.0.7 as affected until the repository confirms otherwise)
Fixed in
- Version 2.0.7 (fix commit bfd727b6cf1daa671c3528d1d681f55b70e8fb19, pull request 16)
Workaround
Unknown.
Exploitation
- Not listed in CISA KEV.
- Not known to be exploited according to OffSeq; this is not confirmed.
- CISA SSVC: Exploitation none, Automatable yes, Technical Impact total.
- No public proof of concept found.
Our recommendation
- Search application dependency trees, including transitive dependencies such as package-lock.json, for git-diff versions below 2.0.7.
- Upgrade to git-diff 2.0.7 and rebuild the affected applications.
- Check whether any internet-facing feature passes user-supplied text into git-diff; if so and a vulnerable version was running, review logs and the host for compromise.
- Monitor the repository and NVD for updates, as the record is still being processed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-110634 at OSV (GHSA-6wfj-92cw-88vg) osv.dev
- VulnCheck advisory: git-diff before 2.0.7 OS command injection www.vulncheck.com
- Fix commit bfd727b6cf1daa671c3528d1d681f55b70e8fb19 github.com
- Pull request 16 on git-diff github.com
- git-diff repository github.com
- Mend vulnerability database entry www.mend.io
- OffSeq radar entry radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:06.
Original description (NVD)
git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed document string can embed $(cmd) or backtick substitutions that shelljs.exec evaluates, running commands with Node.js process privileges.
NVD references (5)
- https://github.com/danday74/git-diff
- https://github.com/danday74/git-diff/blob/a85a649badc4c6bba991e87e82382b7d3cdd6634/js/gitDiffReal/generateDif…
- https://github.com/danday74/git-diff/commit/bfd727b6cf1daa671c3528d1d681f55b70e8fb19
- https://github.com/danday74/git-diff/pull/16
- https://www.vulncheck.com/advisories/git-diff-before-2.0.7-os-command-injection-via-gitdiff-input-strings
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.