PT-2026-63511 · Npm · Dangerjs

Wjm2

·

CVE-2026-16629

·

Published

2026-07-22

·

Updated

2026-07-23

CVSS v3.1

5.3

Medium

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Name of the Vulnerable Software and Affected Versions danger danger-js versions prior to 13.0.8
Description An OS command injection issue exists in the CLI component within the danger.git.diffForFile() function located in the source/platforms/git/localGetFileAtSHA.ts file. This occurs when the File argument is manipulated, allowing a local attacker to execute arbitrary operating system commands.
Recommendations Upgrade to version 13.0.8. As a temporary workaround, restrict the use of the danger.git.diffForFile() function until the update is applied.

Exploit

Fix

OS Command Injection

Command Injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-78CWE-77

Related Identifiers

CVE-2026-16629
GHSA-3X93-P86W-5JVH

Affected Products

Dangerjs