{"id":"GHSA-4c96-w8v2-p28j","summary":"Deno vulnerable to command Injection via incomplete shell metacharacter blocklist in node:child_process","details":"## Summary\n\n  A command injection vulnerability exists in Deno's `node:child_process` polyfill (`shell: true` mode) that bypasses the fix\n  for CVE-2026-27190 (GHSA-hmh4-3xvx-q5hr). An attacker who controls arguments passed to `spawnSync` or `spawn` with `shell:\n  true` can execute arbitrary OS commands, bypassing Deno's permission system.\n\n  **Affected versions:** Deno v2.7.0, v2.7.1\n\n  ## Details\n\n  The two-stage argument sanitization in `transformDenoShellCommand` (`ext/node/polyfills/internal/child_process.ts`) has a\n  priority bug: when an argument contains a `$VAR` pattern, it is wrapped in double quotes (L1290) instead of single quotes\n  (L1293). Double quotes in POSIX sh do not suppress backtick command substitution, allowing injected commands to execute.\n\n  Attack chain:\n  1. `escapeShellArg` wraps the argument in single quotes (safe)\n  2. `op_node_parse_shell_args` strips the single-quote delimiters during tokenization (raw argument exposed)\n  3. Re-quoting detects `$VAR` pattern → applies double quotes\n  4. Backtick payload inside double quotes executes via `/bin/sh`\n\n  ## Impact\n\n  **OS Command Injection (CWE-78)**. Any application using `node:child_process` `spawn`/`spawnSync` with `shell: true` and\n  user-controlled arguments is vulnerable. Injected commands execute at the OS process level, outside Deno's permission\n  sandbox. Only `--allow-run` is required.\n\n  ## Mitigation\n\n  Avoid passing user-controlled input as arguments to `spawn`/`spawnSync` with `shell: true`. Use `shell: false` (the default)\n  instead, or validate/sanitize inputs before passing them.","aliases":["CVE-2026-32260"],"modified":"2026-03-14T09:26:22.452856Z","published":"2026-03-13T20:02:18Z","database_specific":{"nvd_published_at":"2026-03-12T20:16:06Z","cwe_ids":["CWE-78"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-03-13T20:02:18Z"},"references":[{"type":"WEB","url":"https://github.com/denoland/deno/security/advisories/GHSA-4c96-w8v2-p28j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32260"},{"type":"PACKAGE","url":"https://github.com/denoland/deno"}],"affected":[{"package":{"name":"deno","ecosystem":"crates.io","purl":"pkg:cargo/deno"},"ranges":[{"type":"SEMVER","events":[{"introduced":"2.7.0"},{"fixed":"2.7.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-4c96-w8v2-p28j/GHSA-4c96-w8v2-p28j.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}