CVE-2026-16629

danger danger-js CLI localGetFileAtSHA.ts danger.git.diffForFile os command injection

State: Published
Severity: 4.8 Medium
Published: Jul 22, 2026
Updated: Jul 28, 2026
Reserved: Jul 22, 2026

Description

A vulnerability was identified in danger danger-js up to 13.0.7. Impacted is the function danger.git.diffForFile of the file source/platforms/git/localGetFileAtSHA.ts of the component CLI. Such manipulation of the argument File leads to os command injection. The attack needs to be performed locally. Upgrading to version 13.0.8 is recommended to address this issue. The name of the patch is 087a7290264cc6fb7154ea8c2552a7b2cb8b33a3. It is advisable to upgrade the affected component.

Scores

CVSS	Score	Vector	Source
4.0	4.8 Medium	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X	VulDB
3.1	5.3 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C	VulDB
3.0	5.3 Medium	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C	VulDB
2.0	4.3 Medium	AV:L/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C	VulDB

Weaknesses

CWE-78 OS Command Injection
CWE-77 Command Injection

Affected Products

Product	Versions
danger-jsdanger	13.0.0Affected 13.0.1Affected 13.0.2Affected 13.0.3Affected 13.0.4Affected 13.0.5Affected 13.0.6Affected 13.0.7Affected 13.0.8Not affected

References

VDB-382377 | danger danger-js CLI localGetFileAtSHA.ts danger.git.diffForFile os command injectionvdb-entrytechnical-description
VDB-382377 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-16629 | CVE Analysis and Reportthird-party-advisory
Submit #860211 | Node.js danger 13.0.7 OS Command Injectionthird-party-advisory
https://github.com/danger/danger-js/pull/1513issue-trackingpatch
https://github.com/danger/danger-js/commit/087a7290264cc6fb7154ea8c2552a7b2cb8b33a3patch
https://github.com/danger/danger-js/releases/tag/13.0.8patch
https://github.com/danger/danger-js/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.