CVE-2026-49402: deno OS Command Injection

Vulnerability summary

CVE-2026-49402 is a high (CVSS 8.1) OS Command Injection vulnerability in deno. EPSS estimates a 0.45% chance of exploitation in the next 30 days, higher than 37.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 23-06-2026
   PublishedVulnerability first disclosed.
2. 25-06-2026
   Last modifiedVulnerability information updated.

Description

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.10, Deno's node:child_process implementation provided an escapeShellArg() helper used when callers passed shell: true to spawn / spawnSync / exec and friends. On Windows, the helper failed to quote arguments that contained cmd.exe metacharacters and did not neutralize % (which cmd.exe expands even inside double-quoted strings). An attacker who controlled any portion of an argument passed to such a call could inject arbitrary additional commands into the spawned cmd.exe invocation. This vulnerability is fixed in 2.7.10.

• CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.