git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API.
CVSS 4.0CRITICAL 9.3·Network·No auth·No interaction·EPSS 0.02348·Published 2026-10-14·Fixed in 2.0.7CWE-78