CVE-2026-16629

MEDIUM

danger danger-js CLI localGetFileAtSHA.ts danger.git.diffForFile os command injection

Title source: cna
STIX 2.1

Description

A vulnerability was identified in danger danger-js up to 13.0.7. Impacted is the function danger.git.diffForFile of the file source/platforms/git/localGetFileAtSHA.ts of the component CLI. Such manipulation of the argument File leads to os command injection. The attack needs to be performed locally. Upgrading to version 13.0.8 is recommended to address this issue. The name of the patch is 087a7290264cc6fb7154ea8c2552a7b2cb8b33a3. It is advisable to upgrade the affected component.

References (8)

Core 8
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-382377 | danger danger-js CLI localGetFileAtSHA.ts danger.git.diffForFile os command injection
https://vuldb.com/vuln/382377
Signature, Permissions Required signature permissions-required
VDB-382377 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/382377/cti
Third Party Advisory third-party-advisory
CVE-2026-16629 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-16629
Third Party Advisory third-party-advisory
Submit #860211 | Node.js danger 13.0.7 OS Command Injection
https://vuldb.com/submit/860211

Scores

CVSS v3 5.3
EPSS 0.0062
EPSS Percentile 46.3%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-77 CWE-78
Status published
Products (9)
danger/danger-js 13.0.0
danger/danger-js 13.0.1
danger/danger-js 13.0.2
danger/danger-js 13.0.3
danger/danger-js 13.0.4
danger/danger-js 13.0.5
danger/danger-js 13.0.6
danger/danger-js 13.0.7
danger/danger-js 13.0.8
Published Jul 22, 2026
Tracked Since Jul 23, 2026