{"id":"EUVD-2026-101262","enisaUuid":"36650205-9d93-3f88-b583-5c2334d312e0","description":"git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed document string can embed $(cmd) or backtick substitutions that shelljs.exec evaluates, running commands with Node.js process privileges.","datePublished":"Oct 14, 2026, 2:17:07 PM","dateUpdated":"Oct 14, 2026, 5:34:01 PM","baseScore":9.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/danday74/git-diff/pull/16\nhttps://github.com/danday74/git-diff/commit/bfd727b6cf1daa671c3528d1d681f55b70e8fb19\nhttps://github.com/danday74/git-diff/blob/a85a649badc4c6bba991e87e82382b7d3cdd6634/js/gitDiffReal/generateDiff/index.js#L26-L30\nhttps://github.com/danday74/git-diff\nhttps://www.vulncheck.com/advisories/git-diff-before-2.0.7-os-command-injection-via-gitdiff-input-strings\n","aliases":"CVE-2026-110634\nGHSA-6wfj-92cw-88vg\n","assigner":"VulnCheck","epss":2.35,"enisaIdProduct":[{"id":"e5baf559-9c5a-3f05-982a-d276c9e03ea6","product":{"name":"git-diff","vendor":{"name":"danday74"}},"product_version":"0 \u003c2.0.7"}],"enisaIdVendor":[{"id":"20cb8814-98c4-3c21-88cd-abf6c4304a91","vendor":{"name":"danday74"}}],"enisaIdVulnerability":[{"id":"0b1cb905-639c-32ef-90ab-82ede2b53ad4","vulnerability":{"id":"CVE-2026-110634","description":"git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed document string can embed $(cmd) or backtick substitutions that shelljs.exec evaluates, running commands with Node.js process privileges.","datePublished":"Oct 14, 2026, 2:17:07 PM","dateUpdated":"Oct 14, 2026, 5:34:01 PM","status":"PUBLISHED","baseScore":9.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/danday74/git-diff/pull/16\nhttps://github.com/danday74/git-diff/commit/bfd727b6cf1daa671c3528d1d681f55b70e8fb19\nhttps://github.com/danday74/git-diff/blob/a85a649badc4c6bba991e87e82382b7d3cdd6634/js/gitDiffReal/generateDiff/index.js#L26-L30\nhttps://github.com/danday74/git-diff\nhttps://www.vulncheck.com/advisories/git-diff-before-2.0.7-os-command-injection-via-gitdiff-input-strings\n","enisa_id":"EUVD-2026-101262\n","assigner":"VulnCheck","epss":2.35,"dataProcessed":"Oct 27, 2026, 7:14:16 AM","vulnerabilityProduct":[{"id":"9004734f-2554-3b1f-9ac1-db3af5c347de","product":{"name":"git-diff","vendor":{"name":"danday74"}},"product_version":"0 \u003c2.0.7"}],"vulnerabilityVendor":[{"id":"a77bbf6a-d1c5-3503-8782-9b7c3faac700","vendor":{"name":"danday74"}}]}},{"id":"6ad558eb-3c3b-3879-a1cf-ea77b0a770af","vulnerability":{"id":"GHSA-6wfj-92cw-88vg","description":"git-diff: OS command injection vulnerability via crafted strings to the gitDiff API","datePublished":"Oct 14, 2026, 3:32:27 PM","dateUpdated":"Oct 27, 2026, 4:09:34 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-110634\nhttps://github.com/danday74/git-diff/pull/16\nhttps://github.com/danday74/git-diff/commit/bfd727b6cf1daa671c3528d1d681f55b70e8fb19\nhttps://github.com/danday74/git-diff\nhttps://github.com/danday74/git-diff/blob/a85a649badc4c6bba991e87e82382b7d3cdd6634/js/gitDiffReal/generateDiff/index.js#L26-L30\nhttps://www.vulncheck.com/advisories/git-diff-before-2.0.7-os-command-injection-via-gitdiff-input-strings\n","enisa_id":"EUVD-2026-101262\n","aliases":"CVE-2026-110634\nGHSA-6wfj-92cw-88vg\n","epss":0.0,"dataProcessed":"Oct 28, 2026, 2:02:34 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}