CVE-2026-110634: OS Command Injection in git-diff

The git-diff package version 2.0.6 and earlier contains a critical OS command injection vulnerability, identified as CVE-2026-110634. The flaw originates within the gitDiff API, which improperly sanitizes user-supplied input before passing it to the underlying system via the shelljs.exec function. An attacker with the ability to influence the document string processed by this API can inject shell metacharacters, specifically command substitutions using $() or backtick syntax. When the library processes these crafted strings, the Node.js application executes the injected commands with the full privileges of the host process. Given that many applications leverage git-diff for automated document processing, this vulnerability poses a significant risk of full system compromise or lateral movement if the hosting Node.js process has elevated system access. This vulnerability has a CVSS v3.1 base score of 9.8, reflecting the severity of unauthenticated remote command execution.

Impact

Successful exploitation allows an unauthenticated attacker to execute arbitrary commands on the server or workstation hosting the Node.js application. This could lead to data exfiltration, installation of persistent backdoors, or the deployment of ransomware. Any application utilizing git-diff versions prior to 2.0.7 as a dependency is currently susceptible to this attack vector.

Recommendation

• Immediately upgrade the git-diff package to version 2.0.7 or later to implement the required input sanitization.
• Audit application code for instances where user-supplied content is passed directly to the gitDiff API without prior validation.
• Implement egress filtering at the network boundary to prevent spawned shells from reaching out to external command-and-control infrastructure.