danger danger-js CLI localGetFileAtSHA.ts danger.git.diffForFile os command injection

published 2026-07-22 3 mo ago modified 2026-10-24 15 d ago also GHSA-3x93-p86w-5jvh , EUVD-2026-47833

cvss: 5.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.1%; EPSS 1.1% chance of exploitation in 30 days, percentile 65%
public exploits: 0; none known

A vulnerability was identified in danger danger-js up to 13.0.7. Impacted is the function danger.git.diffForFile of the file source/platforms/git/localGetFileAtSHA.ts of the component CLI. Such manipulation of the argument File leads to os command injection. The attack needs to be performed locally. Upgrading to version 13.0.8 is recommended to address this issue. The name of the patch is 087a7290264cc6fb7154ea8c2552a7b2cb8b33a3. It is advisable to upgrade the affected component.

Patch / fix

fixed in 2 links 3

npm danger 13.0.8
danger danger-js 13.0.8

github.com/danger/danger-js@087a729 commit
github.com/danger/danger-js#1513 pull request
github.com/danger/danger-js/releases/tag/13.0.8 release

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 3 mo ago (2026-07-28)

Exploit prediction

1.08% chance of exploitation in the next 30 days, higher than 65% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	4.8	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
CNA	3.1	5.3	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C
CNA	3.0	5.3	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C
CNA	2.0	4.3	AV:L/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C
CNA	4.0	4.8	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA	3.1	5.3	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CNA	2.0	4.3	AV:L/AC:L/Au:S/C:P/I:P/A:P
GitHub	3.1	5.3	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Affected packages

ecosystem	package	affected	fixed in
npm	danger	<13.0.8	13.0.8

Affected products

danger danger-js

Classification

Weakness

CWE-78 Improper Neutralization of Special Elements used in an OS Command
CWE-77 Improper Neutralization of Special Elements used in a Command

References

github.com /danger/danger-js/pull/1513
issue-tracking, patch, web
github.com /danger/danger-js/commit/087a7290264cc6fb7154ea8c2552a7b2cb8b33a3
patch, web
github.com /danger/danger-js/releases/tag/13.0.8
patch, web
vuldb.com /vuln/382377
vdb-entry, technical-description, web
vuldb.com /vuln/382377/cti
signature, permissions-required, web
vuldb.com /cve/CVE-2026-16629
third-party-advisory, web
vuldb.com /submit/860211
third-party-advisory, web
github.com /danger/danger-js/
product
nvd.nist.gov /vuln/detail/CVE-2026-16629
advisory
github.com /danger/danger-js
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary