Executive brief
Deno is a runtime environment used to run JavaScript and TypeScript applications. A security flaw in how Deno handles external commands on Windows allows attackers to inject and execute their own malicious commands. This could lead to a full system takeover or unauthorized data access if an application processes untrusted user input through certain system functions.
Technical details
An OS command injection vulnerability exists in Deno's node:child_process implementation on Windows due to insufficient sanitization in the escapeShellArg() helper. When functions like spawn, spawnSync, or exec are called with shell: true, the helper fails to quote arguments containing cmd.exe metacharacters (such as &, |, <, >, ^, !, (, and )) and does not neutralize the % character used for environment variable expansion. An attacker who can control any portion of an argument passed to these functions can inject arbitrary commands or leak environment variables. This issue is specific to Windows and was resolved in Deno version 2.7.10.
Affected products
- denoland Deno < 2.7.10
Timeline
- 2026-05-27: advisory: GitHub advisory published by denoland
- 2026-06-23: disclosed: NVD publication date
- 2026-06-23: patched: Fix confirmed in version 2.7.10