CVE-2026-49402: Deno Command Injection on Windows via child_process Shell Escaping

Technical summary

CVE-2026-49402 is an OS command injection vulnerability (CWE-78) in Deno's node:child_process module. The escapeShellArg() helper function, invoked when callers set shell: true on child process operations, does not adequately sanitize arguments on Windows targets. Specifically, the function fails to quote arguments containing cmd.exe metacharacters and does not neutralize the percent character (%), which cmd.exe interprets and expands even within double-quoted strings. This allows argument-level injection of shell metacharacters and environment variable expansions that are evaluated by cmd.exe at runtime. An attacker-controlled substring in any spawned command's arguments can break out of the intended argument boundary and inject new commands.

Business impact

Applications built with Deno that spawn child processes on Windows with shell: true and pass unsanitized user input risk arbitrary code execution under the privilege context of the Deno process. In cloud and containerized deployments, this could lead to lateral movement, data exfiltration, or supply chain compromise if the affected Deno application is part of a build pipeline or service mesh. Development teams and DevOps engineers using Deno for scripting, automation, or backend services should treat this as a high-priority patch, especially if any child process calls incorporate external input, configuration parameters, or untrusted data sources.

Affected systems

Deno runtime versions prior to 2.7.10 are affected. The vulnerability is specific to Windows operating systems; the escaping bypass does not apply to Unix-like shells which have different metacharacter sets and quoting rules. Any Deno application running on Windows that uses spawn(), spawnSync(), exec(), execSync(), or related child process methods with the shell: true option is potentially vulnerable if arguments are not pre-validated or sourced entirely from trusted, hardcoded sources.

Exploitability

Exploitability requires two conditions: (1) the application must call a child process function with shell: true on Windows, and (2) the attacker must be able to influence at least one argument to that call. The CVSS 3.1 score of 8.1 reflects high impact (confidentiality, integrity, and availability all affected) and network accessibility; however, the AC:H (high attack complexity) factor accounts for the requirement to control argument input and the need for shell: true to be enabled. In scenarios where Deno applications accept user input, load configuration from untrusted sources, or process data from network requests, exploitation is straightforward. No user interaction is required and no special privileges are prerequisite.

Remediation

Upgrade Deno to version 2.7.10 or later. The fix patches the escapeShellArg() function to properly quote arguments and neutralize cmd.exe metacharacters including the percent sign. Organizations should verify their Deno installation version and deploy updates through their standard release management process. For applications that cannot immediately update, the immediate workaround is to avoid setting shell: true unless absolutely necessary, or to rigorously validate and sanitize all arguments before passing them to child process functions using allowlist-based filtering rather than blacklist-based escaping.

Patch guidance

Update Deno to 2.7.10 or any subsequent release. Check your current Deno version using `deno --version`. Patch deployment can typically be done by downloading the latest release from the official Deno repository or using your package manager (e.g., `deno upgrade` if using deno_core, or Docker image updates if containerized). After patching, regression test any code that uses child process spawning with shell: true to ensure functionality is preserved. If you maintain dependencies or projects that vendor Deno code, ensure those projects also update their Deno runtime dependency to 2.7.10 or later.

Detection guidance

Look for Deno applications on Windows systems and audit their source code for calls to spawn(), spawnSync(), exec(), execSync(), execFile(), and execFileSync() with shell: true. Flag any instances where arguments incorporate user input, environment variables, configuration parameters, or data from network sources. Monitor process creation events on Windows systems running Deno applications, looking for unexpected cmd.exe child processes or cmd.exe invocations with unusual or suspicious command-line arguments (e.g., suspicious command separators, environment variable expansions). Review application logs for any errors or warnings related to child process failures that might indicate failed injection attempts. Version scanning tools can confirm Deno versions in use; prioritize systems running versions before 2.7.10.

Why prioritize this

A CVSS score of 8.1 (HIGH severity) combined with the ubiquity of child process spawning in automation, CI/CD, and backend service contexts makes this a high-priority patch. While the attack complexity is rated high due to the need to control input, many real-world Deno applications do accept external input (configuration files, API parameters, user uploads) and pass portions of it to child process calls. Windows-specific command injection vulnerabilities are often underestimated in severity relative to Unix exploits, but cmd.exe's metacharacter behavior and environment variable expansion make them equally dangerous. Any organization using Deno in production, especially for backend services, build automation, or data processing, should treat this as critical. The lack of KEV (Known Exploited Vulnerability) designation does not reduce its priority; it reflects current threat intel status, not severity.

Risk score, explained

The CVSS 3.1 score of 8.1 reflects: Attack Vector: Network (AV:N) — the vulnerability can be triggered via network-delivered input to a Deno application. Attack Complexity: High (AC:H) — the attacker must successfully control an argument passed to a shell-spawned process. Privileges Required: None (PR:N) — no prior privileges are required to trigger the vulnerability if an exposed interface accepts input. User Interaction: None (UI:N) — exploitation is automatic once an attacker-controlled input reaches the vulnerable code path. Scope: Unchanged (S:U) — the impact is confined to the Deno process and the system it runs on. Confidentiality, Integrity, and Availability are all marked as High (C:H/I:H/A:H) because successful exploitation results in arbitrary code execution with full process privileges. The HIGH severity label reflects the intersection of high CVSS score and the prevalence of child process usage in modern Deno applications.

Frequently asked questions