CVE-2026-110634

9.8Critical

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

9.8Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-78

Impact

Remote attackers can execute arbitrary shell commands with the privileges of the Node.js process. They only need to supply untrusted input to an application that passes it into the gitDiff API.

Root cause

The package passes diffed document strings directly into shelljs.exec without sanitization, evaluating embedded command substitutions like $(cmd) or backticks.

Affected systems

git-diff before version 2.0.7

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade the npm git-diff package to version 2.0.7 or later. If patching immediately is not possible, sanitize or reject inputs containing backticks or shell substitution syntax before calling the gitDiff function.

shell

$ npm install git-diff@^2.0.7

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed document string can embed $(cmd) or backtick substitutions that shelljs.exec evaluates, running commands with Node.js process privileges.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-110634