Description
git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed document string can embed $(cmd) or backtick substitutions that shelljs.exec evaluates, running commands with Node.js process privileges.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
danday74 git-diff
Default version status: unaffected
0 to < 2.0.7affected
pkg:npm/git-diffReferences
- https://github.com/danday74/git-diff/pull/16 ↗
- https://github.com/danday74/git-diff/commit/bfd727b6cf1daa671c3528d1d681f55b70e8fb19 ↗
- https://github.com/danday74/git-diff/blob/a85a649badc4c6bba991e87e82382b7d3cdd6634/js/gitDiffReal/generateDiff/index.js#L26-L30 ↗
- https://github.com/danday74/git-diff ↗
- https://www.vulncheck.com/advisories/git-diff-before-2.0.7-os-command-injection-via-gitdiff-input-strings ↗