CVE-2026-27190
Command Injection in Deno node:child_process Before
Publication date: 2026-02-20
Last updated on: 2026-03-02
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| deno | deno | to 2.6.8 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "CVE-2026-27190 is a command injection vulnerability in Deno's Node.js compatibility layer, specifically in the `node:child_process` implementation when using the `spawn` or `spawnSync` functions with the `shell: true` option."}, {'type': 'paragraph', 'content': 'The vulnerability occurs because shell arguments were not properly escaped, allowing an attacker to inject shell metacharacters into the command arguments. This improper sanitization enables execution of arbitrary OS commands by breaking the intended command and appending malicious commands.'}, {'type': 'paragraph', 'content': 'The issue was fixed in Deno version 2.6.8 by implementing proper escaping of shell arguments on both Unix-like and Windows systems, enhancing detection of unsafe shell metacharacters (including newline and carriage return characters), and adding comprehensive tests to prevent injection attempts.'}] [1, 3]
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': 'This vulnerability allows an attacker to execute arbitrary operating system commands remotely without any privileges or user interaction.'}, {'type': 'paragraph', 'content': 'The impact includes full confidentiality compromise (exposure of sensitive data), integrity compromise (modification of data), and availability compromise (disruption of services).'}, {'type': 'paragraph', 'content': "An attacker can exploit this by injecting malicious shell commands through inputs passed to Deno's child process functions, potentially leading to unauthorized system control or damage."}] [3]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': "This vulnerability can be detected by checking if your system is running a vulnerable version of Deno prior to 2.6.8, especially if you use the Node.js compatibility layer's child_process module with the shell option enabled."}, {'type': 'paragraph', 'content': 'A practical detection method involves attempting to reproduce the proof-of-concept injection described in the advisory, such as injecting shell metacharacters (including newline characters) into commands spawned with shell: true and observing if arbitrary commands execute.'}, {'type': 'paragraph', 'content': 'For example, you can test if the system is vulnerable by running a command that tries to inject a newline and create a file, similar to the proof-of-concept:'}, {'type': 'list_item', 'content': 'Create a legitimate script, e.g., `/tmp/legitimate.ts`.'}, {'type': 'list_item', 'content': 'Run a command that injects a newline followed by `touch /tmp/rce_proof` to see if the file `/tmp/rce_proof` is created.'}, {'type': 'paragraph', 'content': 'If the file `/tmp/rce_proof` is created, it indicates the vulnerability is present and arbitrary command execution is possible.'}] [3]
What immediate steps should I take to mitigate this vulnerability?
The primary and immediate mitigation step is to upgrade Deno to version 2.6.8 or later, where this vulnerability has been fixed.
The fix involves proper escaping of shell arguments in the child_process module when using shell: true, preventing shell metacharacter injection.
Until the upgrade can be applied, avoid using the `shell: true` option with untrusted input in the child_process spawn or spawnSync functions to reduce the risk of command injection.
Additionally, review and sanitize any inputs passed to child processes to ensure they do not contain shell metacharacters or newline characters that could be exploited.