What’s Vulnerable › Vulnerabilities

CVE-2026-49402: Deno: Command Injection via spawnSync & spawn on Windows

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-06-23 · updated 2026-10-25
• Weakness: CWE-78

Description

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.10, Deno's node:child_process implementation provided an escapeShellArg() helper used when callers passed shell: true to spawn / spawnSync / exec and friends. On Windows, the helper failed to quote arguments that contained cmd.exe metacharacters and did not neutralize % (which cmd.exe expands even inside double-quoted strings). An attacker who controlled any portion of an argument passed to such a call could inject arbitrary additional commands into the spawned cmd.exe invocation. This vulnerability is fixed in 2.7.10.

Affected products

• denoland deno: before 2.7.10 — fixed in 2.7.10

How to fix

Upgrade to a fixed version: denoland deno 2.7.10. Check the vendor advisory for mitigations.

References

• https://github.com/denoland/deno/security/advisories/GHSA-7xh3-mhg9-jcw8
• https://github.com/denoland/deno/security/advisories/GHSA-7xh3-mhg9-jcw8

Get alerted when CVE-2026-49402 or the next vulnerability affects your stack