EUVD-2026-47833
GHSA-3x93-p86w-5jvh
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack vector and low privileges required to influence repository filenames; unchanged scope with limited per-dimension impact confirmed by CVSS 4.0 source data.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was identified in danger danger-js up to 13.0.7. Impacted is the function danger.git.diffForFile of the file source/platforms/git/localGetFileAtSHA.ts of the component CLI. Such manipulation of the argument File leads to os command injection. The attack needs to be performed locally. Upgrading to version 13.0.8 is recommended to address this issue. The name of the patch is 087a7290264cc6fb7154ea8c2552a7b2cb8b33a3. It is advisable to upgrade the affected component.
AnalysisAI
OS command injection in danger-js up to version 13.0.7 allows low-privileged local attackers to execute arbitrary shell commands by supplying a maliciously crafted file path to the danger.git.diffForFile function. The vulnerable code in localGetFileAtSHA.ts constructs a git command via unsafe template string interpolation and passes it to Node.js exec(), which invokes a shell - meaning any shell metacharacters embedded in a filename (e.g., x";touch /tmp/pwn;#) break out of the quoted argument and run as OS commands. Vendor-released patch 13.0.8 is available; no public exploit has been identified at time of analysis.
Technical ContextAI
danger-js (CPE: cpe:2.3:a:danger:danger-js:*:*:*:*:*:*:*:*) is a Node.js CLI tool widely used in CI/CD pipelines to automate code review feedback. The vulnerable function localGetFileAtSHA in source/platforms/git/localGetFileAtSHA.ts assembled git commands as a template literal string (git show ${sha}:"${path}") and executed them via Node.js child_process.exec(). Because exec() delegates parsing to the system shell, any shell metacharacters in the path argument - such as double quotes, semicolons, or backticks - are interpreted by the shell rather than treated as literal filename characters. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) precisely describes this root cause: user-controlled input is concatenated into a shell command without escaping or allowlisting. The fix (commit 087a7290) replaces exec() with execFile() and passes the git arguments as a JavaScript array, bypassing the shell entirely so metacharacters in filenames are inert.
RemediationAI
Upgrade danger-js to version 13.0.8, which resolves this issue by replacing child_process.exec() with execFile() and passing git arguments as an array rather than a shell-interpolated string (patch commit 087a7290264cc6fb7154ea8c2552a7b2cb8b33a3, available at https://github.com/danger/danger-js/commit/087a7290264cc6fb7154ea8c2552a7b2cb8b33a3 and https://github.com/danger/danger-js/releases/tag/13.0.8). If immediate upgrade is not feasible, a compensating control is to restrict what filenames can appear in repositories processed by danger-js - for example, by enforcing a CI-level filename allowlist that rejects shell metacharacters (;, ", ` `, $, &, |`) via a pre-receive git hook; note this adds repository maintenance overhead and may block legitimate filenames in some ecosystems. Running danger-js inside an isolated container or sandboxed CI environment limits blast radius if injection occurs but does not eliminate the vulnerability.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today