CPE
The git-diff package before 2.0.7 is vulnerable to OS command injection via the gitDiff API, allowing arbitrary command execution with Node.js process privileges through crafted input strings.