Deno: OS command injection in node:child_process on Windows

Summary

Deno versions 2.7.0 through 2.9.7 on Windows escape shell arguments for the wrong shell type in node:child_process. An attacker who can pass untrusted arguments to calls using the shell option can inject OS commands and run them with the privileges of the Deno process. Exploitation requires an application that passes untrusted input to shell-enabled calls.

Affected

• Deno 2.7.0 through 2.9.7 on Windows (per CVE record and VulnCheck)
• Other platforms: not affected according to the CVE record

Fixed in

• Unknown. A secondary source states Deno 2.9.8 or later, but the vendor has not confirmed this and the Deno 2.9.8 changelog does not clearly list the fix.
• A GitLab advisory for CVE-2026-49402 describes a related Windows flaw and states 2.7.10 as the fixed version; the conflict has not been resolved.

Workaround

• No vendor workaround identified.
• Avoid user-controlled input in shell-enabled calls; use shell: false (the default) and validate or sanitize inputs.
• Use fixed command allowlists and keep untrusted data out of command strings.
• Run Deno with minimum OS privileges; Deno permissions do not contain injected OS commands.

Exploitation

• CISA KEV: Not listed according to available sources (not verified directly against the CISA catalog).
• Public proof of concept: None found for this CVE.
• CISA SSVC: Exploitation none, not automatable, total technical impact.
• EPSS value is provisional (0.01471 per Vulners).

Our recommendation

• Check whether Deno is installed on Windows systems and which version is in use, especially within 2.7.0 to 2.9.7.
• Update to the latest Deno release and confirm the fixed version with Deno before relying on it.
• Review applications that call node:child_process with the shell option and untrusted input; remove or sanitize such input.
• Run Deno with least privileges and monitor for unexpected child processes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• VulnCheck advisory www.vulncheck.com
• Deno fix pull request 36772 github.com
• Deno child_process.ts source (commit 0c07124, line 1339) github.com
• Deno child_process.ts source (commit 0c07124, line 1499) github.com
• Deno 2.9.8 release github.com
• Secondary analysis (dev.to) dev.to
• Vulners VulnRichment vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:03.