CVE-2026-16629 danger danger-js CLI localGetFileAtSHA.ts danger.git.diffForFile os command injection
Local attackers can execute arbitrary OS commands via the danger.git.diffForFile function in the danger-js CLI.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-16629?
CVE-2026-16629 is a medium-severity command injection vulnerability in danger-js, published on 22 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability was identified in danger danger-js up to 13.0.7. Impacted is the function danger.git.diffForFile of the file source/platforms/git/localGetFileAtSHA.ts of the component CLI. Such manipulation of the argument File leads to os command injection. The attack needs to be performed locally. Upgrading to version 13.0.8 is recommended to address this issue. The name of the patch is 087a7290264cc6fb7154ea8c2552a7b2cb8b33a3. It is advisable to upgrade the affected component.
Which versions are affected by CVE-2026-16629?
2 open source packages ship an affected version, including danger.
| Package | Affected | Fixed in |
|---|---|---|
danger npm | All versions | 13.0.8 |
danger npm | All versions | 13.0.8 |
How do I fix CVE-2026-16629?
Upgrade danger to 13.0.8 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-16629 being exploited?
There is no known exploitation of CVE-2026-16629 in the wild and no public exploit code.
Sources
Also known as GHSA-3x93-p86w-5jvh.