{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3agit-diff_projectgit-diffnode.js/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:git-diff_project:git-diff:*:*:*:*:*:node.js:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-110634"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["git-diff (\u003c 2.0.7)"],"_cs_severities":["critical"],"_cs_tags":["vulnerability","rce","nodejs"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe git-diff package version 2.0.6 and earlier contains a critical OS command injection vulnerability, identified as CVE-2026-110634. The flaw originates within the gitDiff API, which improperly sanitizes user-supplied input before passing it to the underlying system via the shelljs.exec function. An attacker with the ability to influence the document string processed by this API can inject shell metacharacters, specifically command substitutions using $() or backtick syntax. When the library processes these crafted strings, the Node.js application executes the injected commands with the full privileges of the host process. Given that many applications leverage git-diff for automated document processing, this vulnerability poses a significant risk of full system compromise or lateral movement if the hosting Node.js process has elevated system access. This vulnerability has a CVSS v3.1 base score of 9.8, reflecting the severity of unauthenticated remote command execution.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated attacker to execute arbitrary commands on the server or workstation hosting the Node.js application. This could lead to data exfiltration, installation of persistent backdoors, or the deployment of ransomware. Any application utilizing git-diff versions prior to 2.0.7 as a dependency is currently susceptible to this attack vector.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately upgrade the git-diff package to version 2.0.7 or later to implement the required input sanitization.\u003c/li\u003e\n\u003cli\u003eAudit application code for instances where user-supplied content is passed directly to the gitDiff API without prior validation.\u003c/li\u003e\n\u003cli\u003eImplement egress filtering at the network boundary to prevent spawned shells from reaching out to external command-and-control infrastructure.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T16:32:56Z","date_published":"2026-10-14T16:32:56Z","id":"https://feed.craftedsignal.io/briefs/2026-10-git-diff-rce/","summary":"The git-diff package before 2.0.7 is vulnerable to OS command injection via the gitDiff API, allowing arbitrary command execution with Node.js process privileges through crafted input strings.","title":"CVE-2026-110634: OS Command Injection in git-diff","url":"https://feed.craftedsignal.io/briefs/2026-10-git-diff-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:git-Diff_project:git-Diff:*:*:*:*:*:node.js:*:*","version":"https://jsonfeed.org/version/1.1"}