Description
git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed document string can embed $(cmd) or backtick substitutions that shelljs.exec evaluates, running commands with Node.js process privileges.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| danday74 | git-diff | < 2.0.7 | 2.0.7 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
federiconbaez/cortex9-git-diff-shell-hash-object-injection-model ★ 0 · Nov 9, 2026
Offline educational model of CVE-2026-110634 (git-diff shell hash-object injection)
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | git-diff | < 2.0.7 | 2.0.7 | GHSA-6wfj-92cw-88vg |
References
- https://github.com/danday74/git-diff/pull/16 issue-tracking patch
- https://github.com/danday74/git-diff/commit/bfd727b6cf1daa671c3528d1d681f55b70e8fb19 patch
- https://github.com/danday74/git-diff/blob/a85a649badc4c6bba991e87e82382b7d3cdd6634/js/gitDiffReal/generateDiff/index.js#L26-L30 technical-description
- https://github.com/danday74/git-diff product
- VulnCheck Advisory: git-diff before 2.0.7 OS Command Injection via gitDiff Input Strings third-party-advisory