EUVD-2026-330063

fkie_cve-2026-49402

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.10, Deno's node:child_process implementation provided an escapeShellArg() helper used when callers passed shell: true to spawn / spawnSync / exec and friends. On Windows, the helper failed to quote arguments that contained cmd.exe metacharacters and did not neutralize % (which cmd.exe expands even inside double-quoted strings). An attacker who controlled any portion of an argument passed to such a call could inject arbitrary additional commands into the spawned cmd.exe invocation. This vulnerability is fixed in 2.7.10.

GHSA-7xh3-mhg9-jcw8 — Deno: Command Injection via spawnSync & spawn on Windows

Affected: crates.io: deno

## Summary

Deno's `node:child_process` implementation provided an `escapeShellArg()` helper used when callers passed `shell: true` to `spawn` / `spawnSync` / `exec` and friends. On Windows, the helper failed to quote arguments that contained `cmd.exe` metacharacters such as `&`, `|`, `<`, `>`, `^`, `!`, `(`, `)`, and did not neutralize `%` (which `cmd.exe` expands even inside double-quoted strings). An attacker who controlled any portion of an argument passed to such a call could inject arbitrary additional commands into the spawned `cmd.exe` invocation.

This was the Windows counterpart to CVE-2026-27190, which fixed the same class of bug in the Unix branch of `escapeShellArg`.

## Details

On Windows, `child_process` with `shell: true` ran the command via `cmd.exe /d /s /c "<command line>"`. Deno assembled that command line by joining the program name and each argument through `escapeShellArg()`.

The vulnerable check was:

```ts // If no special characters, return as-is if (!/[\s"\\]/.test(arg)) { return arg; } ```

The regex covered only whitespace, double-quote, and backslash. Any argument containing `cmd.exe`-significant characters but none of those three was returned unquoted and therefore interpreted by the shell. The most straightforward exploit chained commands with `&`:

```js import { spawnSync } from "node:child_process";

spawnSync("echo", ["test&calc.exe"], { shell: true, encoding: "utf-8" }); ```

The reporter confirmed this launched `calc.exe` on Windows…

Most recent entries from all

EUVD-2026-330063

fkie_cve-2026-49402

GHSA-7xh3-mhg9-jcw8 — Deno: Command Injection via spawnSync & spawn on Windows