Arbitrary Command Injection in Deno JavaScript Runtime

CVE-2026-49402

What is CVE-2026-49402?

The Deno JavaScript runtime, prior to version 2.7.10, contained a flaw in its node:child_process implementation. When the 'shell: true' option was used with functions like spawn, spawnSync, or exec, the escapeShellArg() helper did not properly quote arguments containing cmd.exe metacharacters and failed to neutralize the '%' character, leading to potential command injection. Attackers who could manipulate input arguments could inject arbitrary commands into the spawned cmd.exe context. This issue has been addressed in the updated version 2.7.10.

References