CVE-2026-32260 Details
Description
Deno is a JavaScript, TypeScript, and WebAssembly runtime. From 2.7.0 to 2.7.1, A command injection vulnerability exists in Deno's node:child_process polyfill (shell: true mode) that bypasses the fix for CVE-2026-27190. The two-stage argument sanitization in transformDenoShellCommand (ext/node/polyfills/internal/child_process.ts) has a priority bug: when an argument contains a $VAR pattern, it is wrapped in double quotes (L1290) instead of single quotes. Double quotes in POSIX sh do not suppress backtick command substitution, allowing injected commands to execute. An attacker who controls arguments passed to spawnSync or spawn with shell: true can execute arbitrary OS commands, bypassing Deno's permission system. This vulnerability is fixed in 2.7.2.
A command injection vulnerability has been identified in Deno versions 2.7.0 and 2.7.1, specifically within the 'node:child_process' polyfill when 'shell: true' is enabled. This vulnerability allows attackers to execute arbitrary operating system commands, bypassing Deno's permission system. The issue arises from a flaw in the argument sanitization process, where arguments containing a '$VAR' pattern are incorrectly wrapped in double quotes instead of single quotes. In POSIX shell, double quotes do not prevent backtick command substitution, enabling the execution of injected commands. The vulnerability can be exploited by controlling the arguments passed to 'spawnSync' or 'spawn' with 'shell: true'.
Users are advised to avoid using 'shell: true' with 'spawn' or 'spawnSync' and to sanitize or validate inputs if 'shell: true' must be used. The vulnerability is fixed in Deno version 2.7.2.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/denoland/deno/security/advisories/GHSA-4c96-w8v2-p28j | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| deno deno | >= 2.7.0, < 2.7.2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 18, 2026 | Initial Analysis | [email protected] |
| Mar 12, 2026 | New CVE Received | [email protected] |