CVE-2026-27190CWE-78

Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process

High · published February 20, 2026

CVSS v3.1
8.1
EPSS
4%
Percentile
89.2
In the wild
Unconfirmed
What it is

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.6.8, a command injection vulnerability exists in Deno's node:child_process implementation. This vulnerability is fixed in 2.6.8.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.03539 · 89.2th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-02-20T20:52Z
EPSS history
Timeline
  • 20 FEB 20:52Z
    Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process
    cvelistv5