CVE-2026-27190

Name of the Vulnerable Software and Affected Versions Deno versions prior to 2.6.8

Description A command injection issue exists in Deno's node:child process implementation. The issue allows for arbitrary command execution through crafted input provided to the spawnSync function when the shell option is set to true. A proof-of-concept demonstrates the creation of a file (/tmp/rce proof) to confirm successful exploitation. The vulnerable code utilizes the Deno.execPath() function and the spawnSync function with the shell: true option, allowing for command injection via newline characters in the input. The vulnerable parameter is the input to the spawnSync function.

Recommendations Update to Deno version 2.6.8 or later.