Deno 2.7.0 Through 2.9.7 Command Injection Via Node Child Process

Back www.vulncheck.com

Deno 2.7.0 Through 2.9.7 Command Injection Via Node Child Process

www.vulncheck.com • October 1, 2026

Share: View original

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Command Injection Vulnerability in Deno Versions 2.7.0 to 2.9.7 A command injection vulnerability (CVE-2026-103473) has been identified in Deno versions 2.7.0 through 2.9.7 on Windows. This flaw allows attackers to execute arbitrary OS commands via improperly escaped shell arguments in node:child_process. The risk is particularly high for Windows-hosted services and automation workers using JavaScript/TypeScript. Exploitation requires specific vulnerable call paths, but the complexity is high. The vulnerability was published on September 30, 2026, with a CVSS score of 9.2, classifying it as critical. No proof-of-concept or has been confirmed yet. Affected users are advised to upgrade to a patched version and avoid using untrusted input in shell-enabled calls until then. 1 sources 78

Extracted Entities

Attack Types (1)

Command Injection

CWE Weaknesses (1)

CWE-78 - OS Command Injection

MITRE ATT&CK (1)

T1059 - Command and Scripting Interpreter

Tools (1)