CVSS 9.3: Critical Command Injection in git-diff <2.0.7 Requires Immediate Patching

The git-diff library for Node.js contains a critical security flaw that allows remote attackers to execute operating system commands. This vulnerability, identified as CVE-2026-110634, affects all versions of the package released before 2.0.7. Applications that rely on this library to generate code differences are exposed to significant risk if they process input from untrusted sources. The flaw stems from how the library handles string data passed to its core API functions.

What is the technical root cause?

The vulnerability is classified as an OS command injection weakness, corresponding to CWE-78 in the Common Weakness Enumeration database. According to the National Vulnerability Database record, the git-diff library uses the shelljs.exec function to process diff operations. This function interprets specific shell syntax within the strings it receives. When an attacker controls the document string being diffed, they can embed command substitution syntax. This allows the underlying shell to execute arbitrary commands with the same privileges as the Node.js process.

How do attackers exploit this flaw?

Attackers can exploit this issue by supplying crafted strings to the gitDiff API. The National Vulnerability Database notes that these crafted strings can contain dollar-sign parentheses or backtick substitutions. When the library passes these strings to shelljs.exec, the shell interprets the embedded syntax as commands to be run. This results in arbitrary code execution on the host system. The commands run with the privileges of the Node.js application, potentially allowing full system compromise if the application runs with elevated rights.

Which environments are at risk?

Any Node.js application using the danday74 git-diff library in versions prior to 2.0.7 is potentially vulnerable. The National Vulnerability Database identifies this specific package and version range as affected. Applications that accept user-generated content and pass it through the gitDiff API without sanitization are at the highest risk. This includes web services that allow users to upload or edit code snippets for comparison. The severity rating of 9.3 indicates that the flaw is critical and requires immediate attention from security teams.

What is the current remediation status?

The National Vulnerability Database record specifies that versions before 2.0.7 are affected. This implies that version 2.0.7 and later contain the fix for this vulnerability. Security teams should verify their current installed versions of the git-diff package. If a version earlier than 2.0.7 is in use, updating to the latest available version is the primary mitigation strategy. No other temporary fixes or workarounds are mentioned in the source material. Teams should audit their dependency trees to ensure all transitive dependencies are updated.

Detection notes

Security operations teams should monitor for unusual shell execution patterns originating from Node.js processes. Look for instances where application logs show the execution of commands that were not explicitly part of the application's normal workflow. Check for the presence of shell metacharacters, such as dollar signs or backticks, in input logs associated with diff operations.

Alert on any outbound network connections initiated by the application that do not match expected service calls. Review file system changes for unexpected modifications or new files created during diff processing. Isolate affected systems if suspicious command execution is confirmed to prevent lateral movement.

Background: National Vulnerability Database

The National Vulnerability Database is the U.S. government’s repository of security flaws in software and hardware. It assigns unique identifiers to each issue, allowing organizations to track, prioritize, and remediate risks using standardized references rather than vague descriptions.

Read the full guide: National Vulnerability Database: Meaning, Structure, and Daily Use

What to do and how to stay safe: git-diff

• Audit your Node.js project dependencies to identify if you are using a version of the git-diff library prior to 2.0.7.
• Update the git-diff package to version 2.0.7 or later to apply the vendor-provided fix for this command injection flaw.
• Implement strict input validation and sanitization for any data passed to the gitDiff API to block shell metacharacters.
• Monitor application logs for unexpected shell command executions or unusual process spawns originating from your Node.js services.

Step-by-step guide: Lateral Movement Prevention Checklist for Network Security

General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-110634?

The CVSS score for this vulnerability is 9.3, which is rated as critical severity.

Which specific library version is affected by this flaw?

The danday74 git-diff library is affected in all versions before 2.0.7.

How can an attacker exploit this vulnerability?

Attackers can exploit this by supplying crafted strings with shell substitutions to the gitDiff API, causing shelljs.exec to run arbitrary commands.