CVE-2026-103473 in Deno
Summary
by MITRE • 09/30/2026
Deno versions 2.7.0 through 2.9.7 on Windows contain a command injection vulnerability in node:child_process where shell arguments are escaped for the wrong shell type. Attackers can inject OS commands by passing untrusted arguments with the shell option, allowing arbitrary command execution with Deno process privileges.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/30/2026
The identified security flaw resides within the Node.js compatibility layer of Deno versions 2.7.0 through 2.9.7 on Windows operating systems. Specifically, the vulnerability affects the node:child_process module when invoked with shell options enabled. The core technical deficiency lies in the argument escaping mechanism employed by this module during command execution. When a user or application passes arguments to be executed via a system shell, Deno attempts to sanitize these inputs to prevent unintended code injection. However, on Windows platforms, the implementation incorrectly applies escaping rules intended for Unix-like shells rather than those appropriate for the Windows Command Prompt (cmd.exe) or PowerShell environments. This mismatch in logic results in insufficient sanitization of special characters that hold specific meaning within the Windows shell context, such as ampersands, pipes, and redirection operators.
This technical misconfiguration creates a direct pathway for command injection attacks against applications utilizing these affected Deno versions. An attacker who can control or influence any input passed to the child process execution function with the shell option enabled is able to bypass the intended security boundaries. By injecting carefully crafted payloads containing Windows-specific metacharacters, an adversary can terminate the original intended command and append arbitrary operating system commands for immediate execution. The severity of this vulnerability is significantly amplified by the context in which Deno typically operates; since these processes often run with the privileges of the user launching them, successful exploitation grants the attacker full control over the underlying operating system within that security context.
The operational impact of this vulnerability extends beyond simple command execution to encompass a complete compromise of application integrity and data confidentiality. An exploited instance allows for arbitrary code execution, which can lead to unauthorized access to sensitive files, installation of persistent backdoors, or use of the compromised host as a pivot point for further network attacks. This aligns with Common Weakness Enumeration identifier CWE-78, which classifies improper neutralization of special elements used in an OS command, commonly known as OS Command Injection. The attack vector is consistent with MITRE ATT&CK technique T1059, specifically sub-techniques related to Windows Command Shell execution such as T1059.003 or PowerShell-based execution via T1059.001 if the payload leverages PowerShell features through the shell interface.
Mitigation strategies must prioritize immediate version updates and architectural adjustments where possible. The most effective remediation is upgrading Deno to a patched release that corrects the platform-specific escaping logic for Windows environments. For organizations unable to upgrade immediately, strict input validation should be implemented at the application layer before any data reaches the child_process module. Developers should avoid using shell options whenever direct execution of binaries without an intermediate shell interpreter is sufficient, as this bypasses the vulnerable code path entirely. If shell invocation is unavoidable, inputs must be rigorously sanitized against Windows-specific metacharacters and validated against a whitelist of expected values to prevent injection attempts from succeeding in production environments.