OS Command Injection

git-diff is vulnerable to OS command injection. The vulnerability is due to improper handling of user-controlled diff strings by shelljs.exec, which allows an attacker to inject shell commands using $ or backtick substitutions and execute arbitrary commands with Node.js process privileges...