Cpe:2.3:a:deno:deno:2.9.7:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3adenodeno2.9.7/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 30 Sep 2026 18:36:27 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCommand Injection in Deno node:child_process Modulehttps://feed.craftedsignal.io/briefs/2026-09-deno-command-injection/Wed, 30 Sep 2026 18:36:27 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-deno-command-injection/Deno versions 2.7.0 through 2.9.7 on Windows are vulnerable to command injection in the node:child_process module due to improper shell argument escaping.Deno versions 2.7.0 through 2.9.7 on Windows contain a critical command injection vulnerability within the built-in node:child_process module. This flaw occurs because the implementation fails to correctly escape shell arguments when the shell option is enabled, causing the environment to process inputs for the incorrect shell type. An attacker capable of influencing the arguments passed to a child process via this module can escape the intended command context to execute arbitrary operating system commands. This execution occurs with the same privileges as the Deno runtime process. This vulnerability is particularly impactful for server-side applications, build tools, or automated workflows written in Deno that process external or untrusted data using the child_process spawning utilities.

Impact

Successful exploitation allows for unauthorized arbitrary command execution on the host Windows system. This could lead to full system compromise, data exfiltration, or lateral movement depending on the service account context running the Deno application. Organizations using these specific Deno versions on Windows should prioritize upgrading to a patched release.

Recommendation

  • Upgrade all Deno instances on Windows to version 2.9.8 or later, where the shell argument escaping logic has been corrected.
  • Audit Deno application codebases to identify instances where the node:child_process module is used with the 'shell' option and where untrusted input is passed to the argument array.
  • Apply the principle of least privilege by running Deno processes under service accounts with limited filesystem and network permissions to mitigate the impact of potential command injection.
]]>highadvisoryvulnerabilitycommand-injectiondenowindows