TI-2026-24789 Aliases CVE-2026-32260 GHSA-4c96-w8v2-p28j

Command Injection via incomplete shell metacharacter blocklist in node:child_process (bypass of CVE-2026-27190 fix)

MEDIUM 46CWE-78Published 2026-03-12 · Updated 2026-03-13

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-78.

Summary

Deno is a JavaScript, TypeScript, and WebAssembly runtime. From 2.7.0 to 2.7.1, A command injection vulnerability exists in Deno's node:child_process polyfill (shell: true mode) that bypasses the fix for CVE-2026-27190. The two-stage argument sanitization in transformDenoShellCommand (ext/node/polyfills/internal/child_process.ts) has a priority bug: when an argument contains a $VAR pattern, it is wrapped in double quotes (L1290) instead of single quotes. Double quotes in POSIX sh do not suppress backtick command substitution, allowing injected commands to execute. An attacker who controls arguments passed to spawnSync or spawn with shell: true can execute arbitrary OS commands, bypassing Deno's permission system. This vulnerability is fixed in 2.7.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01635 76th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed deno (denoland): 2.7.2deno (crates.io): 2.7.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
denoland	deno	2.7.0 to before 2.7.2	2.7.2	Patch available	CNA
—	deno (crates.io)	2.7.0 to before 2.7.2	2.7.2	Patch available	GHSA-4c96-w8v2-p28j

deno Vendordenoland Affected 2.7.0 to before 2.7.2 Fixed in 2.7.2 Patch available CNA
deno (crates.io) Vendor— Affected 2.7.0 to before 2.7.2 Fixed in 2.7.2 Patch available GHSA-4c96-w8v2-p28j

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:deno:deno::::::::	2.7.0 to before 2.7.2	Vulnerable	denoland

cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:* Versions 2.7.0 to before 2.7.2 Vulnerable ·denoland

Remediation

Fix · CNA deno (denoland) Fixed in 2.7.2
Fix · GHSA-4c96-w8v2-p28j deno (crates.io) Fixed in 2.7.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-32260
2026-10-03 Alias added: GHSA-4c96-w8v2-p28j

References

TI-2026-21627 Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process CVSS 3.1CRITICAL 9.8
TI-2025-17782 Deno's AES GCM authentication tags are not verified CVSS 4.0HIGH 7.7
TI-2024-18537 *const c_void / ExternalPointer unsoundness leading to use-after-free CVSS 3.1HIGH 8.8
TI-2024-18536 Deno arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypass CVSS 3.1HIGH 8.8
TI-2023-12990 Deno is vulnerable to interactive `run` permission prompt spoofing via improper ANSI neutralization CVSS 3.1HIGH 8.8
TI-2023-11328 Regular expression denial of service in deno CVSS 3.1HIGH 7.5

See all 37 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences