PT-2026-20983 · Deno · Deno

Jackhax · Published 2026-02-19 · Updated 2026-04-14 · CVE-2026-27190

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Deno versions prior to 2.6.8

Description A command injection issue exists in Deno's node:child process implementation. The issue allows for arbitrary command execution through crafted input provided to the spawnSync function when the shell option is set to true. A proof-of-concept demonstrates the creation of a file (/tmp/rce proof) to confirm successful exploitation. The vulnerable code utilizes the Deno.execPath() function and the spawnSync function with the shell: true option, allowing for command injection via newline characters in the input. The vulnerable parameter is the input to the spawnSync function.

Recommendations Update to Deno version 2.6.8 or later.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-27190

GHSA-HMH4-3XVX-Q5HR

JLSEC-2026-116

Affected Products

Deno

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27190.json · Exploit
• https://github.com/denoland/deno/security/advisories/GHSA-hmh4-3xvx-q5hr · Vendor Advisory
• https://github.com/denoland/deno/commit/9132ad958c83a0d0b199de12b69b877f63edab4c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-27190 · Security Note
• https://osv.dev/vulnerability/JLSEC-2026-116 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27190 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hmh4-3xvx-q5hr · Vendor Advisory
• https://github.com/denoland/deno · Note
• https://github.com/denoland/deno/releases/tag/v2.6.8 · Note
• https://github.com/advisories/GHSA-hmh4-3xvx-q5hr · Note
• https://reddit.com/r/VulnMatter/comments/1raarn5/resumen_diario_de_vulnerabilidades_20022026 · Reddit Post
• https://twitter.com/CveTodo/status/2024959765269352607 · Twitter Post
• https://t.me/CVEtracker/47289 · Telegram Post
• https://twitter.com/CVEnew/status/2024988760644223336 · Twitter Post
• https://t.me/cveNotify/153723 · Telegram Post