by Kastro
Paper/Archive/CVE-2026-103473

CVE-2026-103473

denoland deno — Deno 2.7.0 through 2.9.7 Command Injection via node:child_process

EPSS 1%CVSS 9.2
critical.is priorityof 100
42
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 73.7.737 × 2014.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Deno versions 2.7.0 through 2.9.7 on Windows contain a command injection vulnerability in node:child_process where shell arguments are escaped for the wrong shell type. Attackers can inject OS commands by passing untrusted arguments with the shell option, allowing arbitrary command execution with Deno process privileges.

Affected

ProductAffectedFixed inSource
deno2.7.0 – 2.9.7–CNA

Scores by source

VulnCheck (CNA)9.2CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
VulnCheck (CNA)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

patchgithub.com/denoland/deno/pull/36772refgithub.com/denoland/denowriteupgithub.com/denoland/deno/blob/0c071246a412575e07423263404a5d13e7ed6aa2/ext/node/polyfills/internal/child_process.ts#L1499writeupgithub.com/denoland/deno/blob/0c071246a412575e07423263404a5d13e7ed6aa2/ext/node/polyfills/internal/child_process.ts#L1339writeupvulncheck.com/advisories/deno-2.7.0-through-2.9.7-command-injection-via-node-child-process