CVE-2026-33718

CVE-2026-33718 OpenHands is Vulnerable to Command Injection through its Git Diff Handler Donate Support the maintenance of this project with PayPal or by scanning the QR code below. ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker...

OS Command Injection

git-diff is vulnerable to OS command injection. The vulnerability is due to improper handling of user-controlled diff strings by shelljs.exec, which allows an attacker to inject shell commands using $ or backtick substitutions and execute arbitrary commands with Node.js process privileges...

Git-diff: OS Command Injection Vulnerability Via Crafted Strings To The GitDiff API

git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed document string can embed $cmd or backtick substitutions that shelljs.exec evaluates, running comman...

git-diff: OS command injection vulnerability via crafted strings to the gitDiff API

git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed document string can embed $cmd or backtick substitutions that shelljs.exec evaluates, running comman...

GHSA-6WFJ-92CW-88VG git-diff: OS command injection vulnerability via crafted strings to the gitDiff API

git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed document string can embed $cmd or backtick substitutions that shelljs.exec evaluates, running comman...

@hankts/shopify-cli (>=3.53.0, <=3.56.0), @hankts/shopify-cli-kit (>=3.53.0, <=3.53.2) +24 more potentially affected by CVE-2026-110634 via git-diff (2.0.6)

git-diff NPM version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on git-diff and may be impacted: - @hankts/shopify-cli =3.53.0, =3.53.0, =3.53.0, =0.0.0-experimental-20230628155405, =0.0.0-experimental-20230628155405,...

@hankts/shopify-cli (>=3.53.0, <=3.56.0), @hankts/shopify-cli-kit (>=3.53.0, <=3.53.2) +24 more potentially affected by CVE-2026-110634 via git-diff (2.0.6)

git-diff NPM version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on git-diff and may be impacted: - @hankts/shopify-cli =3.53.0, =3.53.0, =3.53.0, =0.0.0-experimental-20230628155405, =0.0.0-experimental-20230628155405,...

CVE-2026-110634

git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed document string can embed $cmd or backtick substitutions that shelljs.exec evaluates, running comman...

CVE-2026-110634 git-diff before 2.0.7 OS Command Injection via gitDiff Input Strings

git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed document string can embed $cmd or backtick substitutions that shelljs.exec evaluates, running comman...

CVE-2026-110634

git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed document string can embed $cmd or backtick substitutions that shelljs.exec evaluates, running comman...

EUVD-2026-101262

git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed document string can embed $cmd or backtick substitutions that shelljs.exec evaluates, running comman...

CVE-2026-110634 git-diff before 2.0.7 OS Command Injection via gitDiff Input Strings

git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed document string can embed $cmd or backtick substitutions that shelljs.exec evaluates, running comman...

CVE-2026-110634

The git-diff library (versions before 2.0.7 ) is vulnerable to OS Command Injection via the gitDiff API . The root cause is that the library fails to properly neutralize special characters in diffed document strings, allowing attackers to embed $(cmd) or backtick substitutions . These substitutio...

@hankts/shopify-cli (>=3.53.0, <=3.56.0), @hankts/shopify-cli-kit (>=3.53.0, <=3.53.2) +24 more potentially affected by CVE-2026-110634 via git-diff (2.0.6)

git-diff NPM version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on git-diff and may be impacted: - @hankts/shopify-cli =3.53.0, =3.53.0, =3.53.0, =0.0.0-experimental-20230628155405, =0.0.0-experimental-20230628155405,...

CVE-2026-110634: Improper Neutralization of Special Elements used in an OS Command

git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed document string can embed $cmd or backtick substitutions that shelljs.exec evaluates, running comman...

PT-2026-114076

git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed document string can embed $cmd or backtick substitutions that shelljs.exec evaluates, running comman...

[SECURITY] Fedora 45 Update: ocaml-patch-3.1.2-3.fc45

The patch module lets you apply your unified diffs in pure OCaml. The loosely specified diff file format is widely used for transmitting differences of line-based information. The motivating example is opam, which is able to validate updates being cryptographically signed by providing a unified...

GHSA-W2VW-W76X-QR89 Nx: OS command injection via git revisions and remote refs

Summary Nx core builds several git invocations as shell command strings with untrusted values interpolated into them, so a value that should be a git revision or ref is parsed by /bin/sh instead. Two entry points are reachable by an attacker: affected commands, where defaultBase /...

PT-2026-115376

Summary Nx core builds several git invocations as shell command strings with untrusted values interpolated into them, so a value that should be a git revision or ref is parsed by /bin/sh instead. Two entry points are reachable by an attacker: affected commands, where defaultBase /...

CVE-2026-102437

OS Command Injection in internal/gitcmd git diff filter.clean/smudge invocation in esengine DeepSeek-Reasonix Reasonix Studio allows a local attacker who controls repository content .gitattributes + .git/config to execute arbitrary commands via the desktop app's workspace-changes diff viewer...