Git Diff
Monthly
OS command injection in the npm package git-diff (danday74/git-diff) before 2.0.7 lets unauthenticated attackers execute arbitrary shell commands with the privileges of the Node.js process by passing crafted document strings into the gitDiff API. The library hashed each input with a shell command of the form `printf "..." | git hash-object -w --stdin` evaluated through shelljs.exec, so payloads containing $(cmd) or backtick substitutions survived the JSON.stringify escaping and were executed. The vendor has published an upstream fix that removes the shell invocation entirely, and no public exploit code has been identified at time of analysis; the assessed CVSS 4.0 base score is 9.3 (Critical) for maximal confidentiality, integrity and availability impact to the vulnerable system.
OS command injection in the npm package git-diff (danday74/git-diff) before 2.0.7 lets unauthenticated attackers execute arbitrary shell commands with the privileges of the Node.js process by passing crafted document strings into the gitDiff API. The library hashed each input with a shell command of the form `printf "..." | git hash-object -w --stdin` evaluated through shelljs.exec, so payloads containing $(cmd) or backtick substitutions survived the JSON.stringify escaping and were executed. The vendor has published an upstream fix that removes the shell invocation entirely, and no public exploit code has been identified at time of analysis; the assessed CVSS 4.0 base score is 9.3 (Critical) for maximal confidentiality, integrity and availability impact to the vulnerable system.