npm git-diff vulnerabilities

Latest npm git-diff CVEs

Newest publication first

1. CVE-2026-110634 git-diff before 2.0.7 OS Command Injection via gitDiff Input Strings

   Published 2026-10-14

   Critical·CVSS 9.3

   git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed document string can embed $(cmd) or backtick substitutions that shelljs.exec evalua...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.