git-diff CVE-2026-110634

Requires an application that passes attacker-controllable document strings into git-diff's gitDiff API (versions before 2.0.7, which hash inputs via a shell printf ... | git hash-object command executed by shelljs.exec). The payload must contain shell command-substitution syntax ($(...) or backticks), which survives JSON.stringify escaping and is evaluated by the shell. The key limiting factor is deployment context: exploitation is only reachable if untrusted input flows into the diffed strings - applications that diff only trusted/internal content are not exposed. Resulting commands run with the privileges of the Node.js process, so impact scales with how that process is privileged and sandboxed.

The CVSS 4.0 base score of 9.3 (Critical) reflects a maximal-impact OS command injection: network vector, low complexity, no privileges, no user interaction, with high confidentiality, integrity and availability impact to the vulnerable system (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H). However, this is a design-level caveat rather than a universally remote bug: git-diff is a library, and the 'network/unauthenticated' characterization only holds when the consuming application forwards attacker-controlled document strings into the gitDiff API. Where the diffed strings are internal/trusted, real exposure drops sharply. No EPSS score and no KEV status were provided in the input, so exploitation probability and active-exploitation signals cannot be assessed - their absence is not evidence of low risk, but it means there is no public-exploitation data point to corroborate the high CVSS. No public exploit code was identified; the only public artifact is the vendor fix (PR #16 / commit bfd727b) which clearly reveals the vulnerable shell-interpolation pattern and thus lowers the effort to weaponize. Net assessment: a genuinely high-severity, easily-understood injection flaw, but real-world priority is gated by how widely the small git-diff package is deployed and whether applications expose its input to untrusted data - treat as high priority for any service that diffs user-supplied content, lower for internal tooling.

An application that diffs user-submitted documents calls git-diff's gitDiff API with an attacker-controlled string such as 'hello $(id > /tmp/pwned)'. Because the pre-2.0.7 code interpolates the string into a printf "..." | git hash-object shell command and runs it through shelljs.exec, the $(...) substitution is evaluated by the shell, executing arbitrary OS commands with the Node.js process's privileges. No public exploit code is identified, but the vendor's patch commit discloses the exact vulnerable code path.