CVE-2026-110634

Summary

This vulnerability allows attackers to inject and execute arbitrary OS commands through the git-diff API by embedding shell command substitutions in diffed document strings. The flaw is critical because it can lead to complete system compromise when Node.js process privileges are leveraged.

Exploitability

Exploitation is straightforward for attackers who can control diffed document content, requiring only the ability to inject $(cmd) or backtick syntax that gets evaluated by shelljs.exec.

Blast radius

The impact could be severe across any system running vulnerable git-diff versions, particularly affecting web applications that process user-submitted diffs or document content through this API.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to git-diff version 2.0.7 or later to remediate the OS command injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.