| Package | Affected versions | Patched versions |
|---|---|---|
| diffy | < 3.4.1 | 3.4.1 |
| diffy | = 3.4.1 |
The function that calls the diff tool in versions of Diffy prior to 3.4.1 does not properly handle double quotes in a filename when run in a Windows environment. This allows attackers to execute arbitrary commands via a crafted string.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free