CVE-2026-16629

Received Received - Intake

OS Command Injection in danger danger-js

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: VulDB

Description

A vulnerability was identified in danger danger-js up to 13.0.7. Impacted is the function danger.git.diffForFile of the file source/platforms/git/localGetFileAtSHA.ts of the component CLI. Such manipulation of the argument File leads to os command injection. The attack needs to be performed locally. Upgrading to version 13.0.8 is recommended to address this issue. The name of the patch is 087a7290264cc6fb7154ea8c2552a7b2cb8b33a3. It is advisable to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-22

Last Modified

2026-07-22

Generated

2026-07-23

AI Q&A

2026-07-23

EPSS Evaluated

N/A

NVD

CVE-2026-16629

EUVD

EUVD-2026-47833

Affected Vendors & Products

Vendor	Product	Version / Range
danger	danger-js	to 13.0.7 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-77	The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is an OS command injection flaw in the danger danger-js library up to version 13.0.7. It exists in the danger.git.diffForFile function within the source/platforms/git/localGetFileAtSHA.ts file. The issue arises from improper handling of the File argument, allowing local attackers to execute arbitrary commands on the system.

Detection Guidance

This vulnerability is specific to the danger danger-js library up to version 13.0.7 and requires local access to exploit. Detection involves checking the installed version of the library. Run: npm list danger or grep "danger" package.json to verify the version. If version 13.0.7 or lower is installed, the system is vulnerable.

Impact Analysis

If exploited, this vulnerability could allow an attacker with local access to run unauthorized commands on your system. This may lead to data theft, system compromise, or further network infiltration depending on the permissions of the affected application.

Compliance Impact

This vulnerability involves local command injection in danger danger-js, which could allow unauthorized code execution on a system. While not directly tied to GDPR or HIPAA, such vulnerabilities may lead to unauthorized access to sensitive data, potentially violating compliance requirements for data protection and security.

Mitigation Strategies

Upgrade the danger danger-js library to version 13.0.8 or later immediately. Use the command: npm update danger or npm install [email protected]. This patch addresses the command injection vulnerability in the git.diffForFile function.

Hi! I’m here to help you understand CVE-2026-16629. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70