CVE-2026-16629 in danger-js
Summary
by MITRE • 07/23/2026
A vulnerability was identified in danger danger-js up to 13.0.7. Impacted is the function danger.git.diffForFile of the file source/platforms/git/localGetFileAtSHA.ts of the component CLI. Such manipulation of the argument File leads to os command injection. The attack needs to be performed locally. Upgrading to version 13.0.8 is recommended to address this issue. The name of the patch is 087a7290264cc6fb7154ea8c2552a7b2cb8b33a3. It is advisable to upgrade the affected component.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/23/2026
This vulnerability resides within the danger-js JavaScript library, specifically affecting versions up to 13.0.7 where a command injection flaw exists in the git.diffForFile function. The issue manifests in the localGetFileAtSHA.ts file within the CLI component, creating a critical security risk when the File argument is manipulated by an attacker. The vulnerability allows for arbitrary operating system command execution through improper input validation and handling of file paths. This represents a classic command injection vulnerability that falls under CWE-78, which specifically addresses improper neutralization of special elements used in OS commands.
The attack vector requires local system access, meaning malicious actors must already have compromised credentials or physical access to the system where danger-js is installed. This limitation reduces the attack surface but does not eliminate the risk entirely, as local privilege escalation or credential compromise scenarios can still lead to exploitation. The vulnerability impacts the CLI functionality of the library and specifically targets how file operations are handled during git diff processing. The patch implemented in commit 087a7290264cc6fb7154ea8c2552a7b2cb8b33a3 addresses this by properly sanitizing and validating input parameters before they are passed to underlying OS commands.
From an operational perspective, this vulnerability poses significant risk to continuous integration environments where danger-js is commonly deployed for automated code review processes. The local execution requirement means that even if the system is not directly exposed to external threats, internal security breaches or compromised user accounts could lead to full system compromise. Organizations using this library in automated build pipelines should consider immediate remediation to prevent potential exploitation. The impact extends beyond simple command execution as successful exploitation could allow attackers to access sensitive data, modify system configurations, or establish persistent access through the compromised CI/CD environment.
Security practitioners should implement multiple layers of defense including regular dependency updates, code scanning tools that identify vulnerable components, and monitoring for unusual command execution patterns. The ATT&CK framework categorizes this vulnerability under T1059.001 Command and Scripting Interpreter with emphasis on local execution techniques. Organizations should also consider implementing principle of least privilege access controls to limit potential damage from compromised systems and establish automated patch management processes to quickly deploy security updates across their infrastructure. The vulnerability demonstrates the importance of input validation in all system components, particularly those that interface directly with operating system functionality through command execution mechanisms.