Executive brief
Danger is a tool used to automate code review tasks within development workflows. A local user with access to a Danger installation can exploit a command injection flaw by providing specially crafted file paths to the git.diffForFile function, allowing them to execute arbitrary system commands. This could lead to unauthorized access to sensitive data or system compromise on machines running Danger.
Technical details
The vulnerability is a command injection flaw (CWE-77) in the localGetFileAtSHA.ts file affecting the danger.git.diffForFile function. The vulnerability arises from improper neutralization of special elements in file path arguments passed to system commands. An attacker with local access and low privileges can exploit this without user interaction by crafting malicious file paths containing shell metacharacters. The attack vector is local with low complexity. Successful exploitation allows an attacker to execute arbitrary OS commands with the privileges of the Danger process, potentially leading to confidentiality, integrity, and availability impacts. The fix is available in version 13.0.8 (commit 087a7290264cc6fb7154ea8c2552a7b2cb8b33a3).
Affected products
- Danger danger-js < 13.0.8
Timeline
- 2026-07-23: disclosed: Vulnerability published to GitHub Advisory Database
- 2026-06-16: patched: Fix merged in commit 087a7290264cc6fb7154ea8c2552a7b2cb8b33a3
- 2026-07-22: advisory: Published to NVD as CVE-2026-16629