CVE-2026-49402 Details

A command injection vulnerability exists in Deno versions prior to 2.7.10, specifically within the 'node:child_process' module. When the 'shell' option is set to true for functions like 'spawn', 'spawnSync', or 'exec', the 'escapeShellArg()' helper is used to sanitize arguments. However, on Windows, this helper fails to properly quote arguments containing 'cmd.exe' metacharacters, such as '&', '|', '<', '>', '^', '!', '(', ')', and does not neutralize '%' (which 'cmd.exe' expands even within double quotes). As a result, an attacker could inject arbitrary commands into the 'cmd.exe' invocation. This vulnerability allows for unauthorized command execution in the context of the Deno process.

Users can upgrade to Deno version 2.7.10 or later, where this vulnerability is fixed. Alternatively, avoid using 'shell: true' in 'node:child_process' calls on Windows, or filter out any argument values that contain 'cmd.exe' metacharacters before passing them to 'spawn', 'spawnSync', or 'exec'.