CVE-2026-110634

The git-diff library (versions before 2.0.7 ) is vulnerable to OS Command Injection via the gitDiff API . The root cause is that the library fails to properly neutralize special characters in diffed document strings, allowing attackers to embed $(cmd) or backtick substitutions . These substitutio...