74 matches found
CVE-2026-33718
CVE-2026-33718 OpenHands is Vulnerable to Command Injection through its Git Diff Handler Donate Support the maintenance of this project with PayPal or by scanning the QR code below. ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker...
CVE-2026-110634
git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed document string can embed $cmd or backtick substitutions that shelljs.exec evaluates, running comman...
CVE-2026-110634 git-diff before 2.0.7 OS Command Injection via gitDiff Input Strings
git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed document string can embed $cmd or backtick substitutions that shelljs.exec evaluates, running comman...
CVE-2026-110634
The git-diff library (versions before 2.0.7 ) is vulnerable to OS Command Injection via the gitDiff API . The root cause is that the library fails to properly neutralize special characters in diffed document strings, allowing attackers to embed $(cmd) or backtick substitutions . These substitutio...
CVE-2026-110634 git-diff before 2.0.7 OS Command Injection via gitDiff Input Strings
git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed document string can embed $cmd or backtick substitutions that shelljs.exec evaluates, running comman...
EUVD-2026-101262
git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed document string can embed $cmd or backtick substitutions that shelljs.exec evaluates, running comman...
[SECURITY] Fedora 45 Update: ocaml-patch-3.1.2-3.fc45
The patch module lets you apply your unified diffs in pure OCaml. The loosely specified diff file format is widely used for transmitting differences of line-based information. The motivating example is opam, which is able to validate updates being cryptographically signed by providing a unified...
GHSA-W2VW-W76X-QR89 Nx: OS command injection via git revisions and remote refs
Summary Nx core builds several git invocations as shell command strings with untrusted values interpolated into them, so a value that should be a git revision or ref is parsed by /bin/sh instead. Two entry points are reachable by an attacker: affected commands, where defaultBase /...
CVE-2026-102437
OS Command Injection in internal/gitcmd git diff filter.clean/smudge invocation in esengine DeepSeek-Reasonix Reasonix Studio allows a local attacker who controls repository content .gitattributes + .git/config to execute arbitrary commands via the desktop app's workspace-changes diff viewer...
CVE-2026-102437 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in DeepSeek-Reasonix
OS Command Injection in internal/gitcmd git diff filter.clean/smudge invocation in esengine DeepSeek-Reasonix Reasonix Studio allows a local attacker who controls repository content .gitattributes + .git/config to execute arbitrary commands via the desktop app's workspace-changes diff viewer...
CVE-2026-102437 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in DeepSeek-Reasonix
OS Command Injection in internal/gitcmd git diff filter.clean/smudge invocation in esengine DeepSeek-Reasonix Reasonix Studio allows a local attacker who controls repository content .gitattributes + .git/config to execute arbitrary commands via the desktop app's workspace-changes diff viewer...
PT-2026-85550
git-mcp-server 2.15.1 contains an argument injection vulnerability in the ref and object parameters of git log, git diff, and git show tools that lack leading-dash validation. Attackers can inject git command-line options like --output= to write files outside the repository to arbitrary paths...
CVE-2026-72718 goose: Arbitrary command execution in goose CLI via `goose review` via git core.fsmonitor
goose is general-purpose AI agent that runs on your machine. Prior to 1.44.0, the goose review command runs the system git executable to gather the diff for review without stripping attacker-controlled Git configuration. A malicious repository whose .git/config sets core fsmonitor = causes Git to...
CVE-2026-19266
A vulnerability was determined in Kirachon context-engine up to 1.9.0. This affects the function execGitCommand of the file src/mcp/utils/gitUtils.ts of the component review-git-diff Endpoint. Executing a manipulation of the argument args can lead to command injection. Upgrading to version 1.9.1...
CVE-2026-19266 Kirachon context-engine review-git-diff Endpoint gitUtils.ts execGitCommand command injection
A vulnerability was determined in Kirachon context-engine up to 1.9.0. This affects the function execGitCommand of the file src/mcp/utils/gitUtils.ts of the component review-git-diff Endpoint. Executing a manipulation of the argument args can lead to command injection. Upgrading to version 1.9.1...
CVE-2026-19266 Kirachon context-engine review-git-diff Endpoint gitUtils.ts execGitCommand command injection
A vulnerability was determined in Kirachon context-engine up to 1.9.0. This affects the function execGitCommand of the file src/mcp/utils/gitUtils.ts of the component review-git-diff Endpoint. Executing a manipulation of the argument args can lead to command injection. Upgrading to version 1.9.1...
PT-2026-69188
Name of the Vulnerable Software and Affected Versions Kirachon context-engine versions prior to 1.9.1 Description Command injection is possible within the review-git-diff Endpoint due to improper handling of the args variable in the execGitCommand function located in the src/mcp/utils/gitUtils.ts...
CVE-2026-19266: Improper Neutralization of Special Elements used in a Command
A vulnerability was determined in Kirachon context-engine up to 1.9.0. This affects the function execGitCommand of the file src/mcp/utils/gitUtils.ts of the component review-git-diff Endpoint. Executing a manipulation of the argument args can lead to command injection. Upgrading to version 1.9.1...
SUSE CVE-2026-52797
Gogs is an open source self-hosted Git service. Prior to 0.14.0, as an authorized user, an intruder can dictate the value which is passed to the git diff command which, together with bypassing the filtering of the passed value, allows the user to bypass the target directory and write the result o...
