What’s Vulnerable › Vulnerabilities

CVE-2026-103473: Deno 2.7.0 through 2.9.7 Command Injection via node:child_process

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-30 · updated 2026-10-02
• Weakness: CWE-78

Description

Deno versions 2.7.0 through 2.9.7 on Windows contain a command injection vulnerability in node:child_process where shell arguments are escaped for the wrong shell type. Attackers can inject OS commands by passing untrusted arguments with the shell option, allowing arbitrary command execution with Deno process privileges.

Affected products

• denoland deno: from 2.7.0 through 2.9.7

References

• https://github.com/denoland/deno
• https://github.com/denoland/deno/blob/0c071246a412575e07423263404a5d13e7ed6aa2/ext/node/polyfills/internal/child_process.ts#L1339
• https://github.com/denoland/deno/blob/0c071246a412575e07423263404a5d13e7ed6aa2/ext/node/polyfills/internal/child_process.ts#L1499
• https://github.com/denoland/deno/pull/36772
• https://www.vulncheck.com/advisories/deno-2.7.0-through-2.9.7-command-injection-via-node-child-process

Get alerted when CVE-2026-103473 or the next vulnerability affects your stack