CVE-2026-16629 | danger danger-js up to 13.0.7 CLI localGetFileAtSHA.ts danger.git.diffForFile os command injection (ID 1513)

July 22, 2026 Yanac

A vulnerability categorized as critical has been discovered in danger danger-js up to 13.0.7. Impacted is the function danger.git.diffForFile of the file source/platforms/git/localGetFileAtSHA.ts of the component CLI. Such manipulation of the argument File leads to os command injection.

This vulnerability is documented as CVE-2026-16629. The attack needs to be performed locally. There is not any exploit available.

It is advisable to upgrade the affected component.VulDB Recent EntriesRead More