AIKIDO-2026-10355

TL;DR

Affected versions of this package allowed insufficient validation of externally supplied diff tool names, which could enable command injection when invoking external diff utilities. The issue was addressed by rejecting names containing shell metacharacters such as ;&|$(){}[]<>!#"' and path traversal patterns. An attacker might exploit this by supplying a crafted tool name that injects additional shell commands or redirects execution to unintended binaries, potentially leading to arbitrary command execution in the context of the affected application.