git-diff versions prior to 2.0.7 contain a critical OS command injection vulnerability. This flaw allows attackers to execute arbitrary shell commands by supplying specially crafted strings to the gitDiff API. The vulnerability arises because the API evaluates these strings using shelljs.exec with Node.js process privileges. A fix is available in version 2.0.7.