CVE-2026-49402: falha de alta gravidade em denoland deno
Deno: Command Injection via spawnSync & spawn on Windows
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.1epss 0.4%
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.10, Deno's node:child_process implementation provided an escapeShellArg() helper used when callers passed shell: true to spawn / spawnSync / exec and friends. On Windows, the helper failed to quote arguments that contained cmd.exe metacharacters and did not neutralize % (which cmd.exe expands even inside double-quoted strings). An attacker who controlled any portion of an argument passed to such a call could inject arbitrary additional commands into the spawned cmd.exe invocation. This vulnerability is fixed in 2.7.10.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
denoland · denoCVEs relacionadas — denoland deno
No mesmo produto, das mais perigosas para as menos.
CVE-2026-27190HIGHDeno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_processEPSS 2.5%CVE-2024-27933HIGHDeno arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypassEPSS 2.3%CVE-2025-61787HIGHDeno is Vulnerable to Command Injection on Windows During Batch File ExecutionEPSS 2.1%CVE-2026-32260HIGHCommand Injection via incomplete shell metacharacter blocklist in node:child_process (bypass of CVE-2026-27190 fix)EPSS 1.6%CVE-2026-103473CRITICALDeno 2.7.0 through 2.9.7 Command Injection via node:child_processEPSS 1.5%CVE-2022-24783CRITICALSandbox bypass leading to arbitrary code execution in DenoEPSS 1.1%