CVE-2026-103473
Deno versions 2.7.0 through 2.9.7 on Windows contain a command injection vulnerability in…
- Risk score
- 68/100
- CVSS
- 8.1 v3.1
- Exploit chance (30 days)
- 1.5%
- Published
- 30 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Deno versions 2.7.0 through 2.9.7 on Windows contain a command injection vulnerability in node:child_process where shell arguments are escaped for the wrong shell type. Attackers can inject OS commands by passing untrusted arguments with the shell option, allowing arbitrary command execution with Deno process privileg…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 8.1 high
- Remotely exploitable without logging in
References
- https://github.com/denoland/deno
- https://github.com/denoland/deno/blob/0c071246a412575e07423263404a5d13e7ed6aa2/ext/node/polyfills/internal/child_process.ts#L1339
- https://github.com/denoland/deno/blob/0c071246a412575e07423263404a5d13e7ed6aa2/ext/node/polyfills/internal/child_process.ts#L1499
- https://github.com/denoland/deno/pull/36772
- https://www.vulncheck.com/advisories/deno-2.7.0-through-2.9.7-command-injection-via-node-child-process
Original description
Deno versions 2.7.0 through 2.9.7 on Windows contain a command injection vulnerability in node:child_process where shell arguments are escaped for the wrong shell type. Attackers can inject OS commands by passing untrusted arguments with the shell option, allowing arbitrary command execution with Deno process privileges.
Last activity 30 Sep 2026. Patch Forecast updates every hour.