PT-2026-50146 · Deno · Deno
CVSS v3.1
8.1
High
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Deno versions prior to 2.7.10
Description
In the
node:child process implementation on Windows, the escapeShellArg() helper function fails to properly quote arguments containing cmd.exe metacharacters (such as &, |, <, >, ^, !, (, and )) and does not neutralize the % character, which cmd.exe expands even within double-quoted strings. This occurs when callers use the spawn, spawnSync, or exec functions with the shell: true option. An attacker who can control any part of an argument passed to these calls can inject and execute arbitrary commands within the context of the Deno process.Recommendations
Update Deno to version 2.7.10.
As a temporary workaround, avoid using
shell: true in node:child process calls on Windows.
As a temporary workaround, build the argument vector directly and invoke the program without a shell.
As a temporary workaround, filter or reject any externally-supplied argument values containing cmd.exe metacharacters (&, |, <, >, ^, !, (, ), %) before passing them to spawn, spawnSync, or exec.Exploit
Fix
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Deno