Quick answers
- Is CVE-2026-49402 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-49402 being exploited in the wild.
- How severe is CVE-2026-49402?
- High severity, with a CVSS score of 8.1, published 23 June 2026.
- Which products and versions are affected?
- deno (crates.io) < 2.7.10, SEMVER:introduced=0,fixed=2.7.10.
- Is there a fix for CVE-2026-49402?
- Yes. deno (crates.io): upgrade to 2.7.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-49402 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-49402?
- Check whether you run deno (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- deno (crates.io): upgrade to 2.7.10 or later
cargo update -p deno
Technical details
An OS command injection vulnerability exists in Deno's node:child_process implementation on Windows due to insufficient sanitization in the escapeShellArg() helper. When functions like spawn, spawnSync, or exec are called with shell: true, the helper fails to quote arguments containing cmd.exe metacharacters (such as &, |, <, >, ^, !, (, and )) and does not neutralize the % character used for environment variable expansion. An attacker who can control any portion of an argument passed to these functions can inject arbitrary commands or leak environment variables. This issue is specific to Windows and was resolved in Deno version 2.7.10.
Affected products
- denoland Deno < 2.7.10
Identifiers
- CVE-2026-49402
- GHSA-7xh3-mhg9-jcw8
Timeline
- 2026-05-27: advisory: GitHub advisory published by denoland
- 2026-06-23: disclosed: NVD publication date
- 2026-06-23: patched: Fix confirmed in version 2.7.10