Git-Diff (< 2.0.7)

The git-diff package before 2.0.7 is vulnerable to OS command injection via the gitDiff API, allowing arbitrary command execution with Node.js process privileges through crafted input strings.