Deno · Deno · CVE-2026-49402
**Name of the Vulnerable Software and Affected Versions**
Deno versions prior to 2.7.10
**Description**
In the `node:child process` implementation on Windows, the `escapeShellArg()` helper function fails to properly quote arguments containing `cmd.exe` metacharacters (such as `&`, `|`, `<`, `>`, `^`, `!`, `(`, and `)`) and does not neutralize the `%` character, which `cmd.exe` expands even within double-quoted strings. This occurs when callers use the `spawn`, `spawnSync`, or `exec` functions with the `shell: true` option. An attacker who can control any part of an argument passed to these calls can inject and execute arbitrary commands within the context of the Deno process.
**Recommendations**
Update Deno to version 2.7.10.
As a temporary workaround, avoid using `shell: true` in `node:child process` calls on Windows.
As a temporary workaround, build the argument vector directly and invoke the program without a shell.
As a temporary workaround, filter or reject any externally-supplied argument values containing `cmd.exe` metacharacters (`&`, `|`, `<`, `>`, `^`, `!`, `(`, `)`, `%`) before passing them to `spawn`, `spawnSync`, or `exec`.