Description

git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed document string can embed $(cmd) or backtick substitutions that shelljs.exec evaluates, running commands with Node.js process privileges.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-10-14T15:17:16.417Z",
  "pubdate": "2026-10-14T15:17:16.417Z",
  "executiveSummary": "A critical OS command injection vulnerability affects the git-diff npm package in versions prior to 2.0.7. The flaw exists within the processing logic of the gitDiff API, which processes user-supplied document strings without sufficient input sanitization or parameterization. If an attacker can influence or control the content of a document string passed to the gitDiff API, they can inject shell meta-characters, specifically command substitution constructs such as $(cmd) or backtick operators.\nBecause the git-diff module evaluates constructed commands using shelljs.exec, the underlying system command shell parses and executes these injected sequences. Successful exploitation grants the attacker arbitrary shell command execution capabilities within the context of the running Node.js process privileges. This presents significant security risks, including unauthorized data access, system compromise, process manipulation, and potential lateral movement across the internal network environment depending on the application exposure.",
  "technicalDetails": "The vulnerability originates from unsafe string concatenation and dynamic shell invocation within the git-diff package prior to version 2.0.7. When the gitDiff API is invoked to compare document strings, the module constructs a command-line string containing the input document data and passes it directly to shelljs.exec. The shelljs.exec function invokes a system shell (such as /bin/sh on POSIX systems or cmd.exe on Windows) to execute the supplied command line.\nBy default, command shells perform parameter expansion and command substitution before command execution. When user input containing command substitution operators—such as $(...) or backticks `...`—is evaluated by shelljs.exec without prior sanitization or argument escaping, the shell interprets the embedded syntax as system commands to be run in a subshell. The primary command execution is hijacked or augmented by the payload commands.\nThe complete attack flow operates as follows:\n1. Input Injection: An attacker crafts a payload containing malicious shell command substitution syntax, such as $(id) or `whoami`, embedded within a document string.\n2. API Invocation: The host application receives the malicious document string from an untrusted source and passes it directly to the gitDiff API.\n3. Command Assembly: The gitDiff function embeds the unescaped input string into a shell command string.\n4. Shell Execution: The module passes the command string to shelljs.exec, triggering a host system shell execution.\n5. Payload Evaluation: The host shell identifies the command substitution syntax ($(cmd) or backticks) and spawns a subshell to execute the embedded commands prior to completing the main shell process.\n6. Arbitrary Code Execution: The injected commands execute successfully with the privileges assigned to the Node.js process.\nBecause the payload executes under the identity of the Node.js runtime process, any elevated operating system privileges or environment access granted to the application will be inherited by the attacker's executed commands."
}