CVE-2026-103473CWE-78command-injection

CVE-2026-103473

High · published September 30, 2026

CVSS v3.1
8.1
EPSS
1%
Percentile
73.6
In the wild
Unconfirmed
What it is

Deno versions 2.7.0 through 2.9.7 on Windows contain a command injection vulnerability in node:child_process where shell arguments are escaped for the wrong shell type. Attackers can inject OS commands by passing untrusted arguments with the shell option, allowing arbitrary command execution with Deno process privileges.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.2 · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.01471 · 73.6th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-09-30T22:18Z
References (5)
https://github.com/denoland/deno · [email protected]https://github.com/denoland/deno/blob/0c071246a412575e07423263404a5d13e7ed6aa2/ext/node/polyfills/internal/child_process.ts#L1339 · [email protected]https://github.com/denoland/deno/blob/0c071246a412575e07423263404a5d13e7ed6aa2/ext/node/polyfills/internal/child_process.ts#L1499 · [email protected]https://github.com/denoland/deno/pull/36772 · [email protected]https://www.vulncheck.com/advisories/deno-2.7.0-through-2.9.7-command-injection-via-node-child-process · [email protected]
EPSS history
Timeline
  • 02 OCT 03:41Z
    EPSS moved — → 3%
    epss
  • 30 SEP 17:22Z
    Deno 2.7.0 through 2.9.7 Command Injection via node:child_process
    cvelistv5