Live › vulnerability › CVE-2026-110634
Go to dashboardThe npm package git-diff before 2.0.7 passes input strings to a shell through shelljs.exec without escaping them. An attacker who controls a diffed string can embed $(cmd) or backtick substitutions and run commands with the Node.js process privileges.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 16:10 UTC, 0h before NVD. All times on this page are UTC.
Applications that import git-diff and call its gitDiff API with strings an outside party can influence, such as user-submitted or uploaded document content. Projects that only diff trusted, internally generated text are exposed far less, and teams that do not depend on the package can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| git-diff | npm | < 2.0.7 | 2.0.7 |
npm ls git-diff in each project to see whether the package is installed and which version resolves.package-lock.json or yarn.lock for git-diff entries below 2.0.7.gitDiff where the input can come from users or external documents.git-diff to 2.0.7 or later.gitDiff.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed document string can embed $(cmd) or backtick substitutions that shelljs.exec evaluates, running commands with Node.js process privileges.
This page as .md · .json · in your agent: get_signal("CVE-2026-110634")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.