CVE-2026-27190: Deno command injection in node:child_process via incomplete shell metacharacter blocklist
Deno versions before 2.6.8 contain a command injection weakness in the node:child_process implementation, classified as CWE-78. The record associates the flaw with an incomplete shell metacharacter blocklist and states that it is fixed in 2.6.8. No confirmed exploitation appears in the sources consulted.
Overview
Deno is a JavaScript, TypeScript and WebAssembly runtime. The record describes a command injection weakness in its node:child_process implementation affecting versions before 2.6.8, classified as CWE-78 (OS Command Injection). The record title attributes the weakness to an incomplete shell metacharacter blocklist, and a patch commit is listed.
Impact
The NVD base vector is network-reachable, low complexity, requires no privileges and no user interaction, and has high impact on confidentiality, integrity and availability. In general terms, an input path that reaches an unsafe shell command could let an attacker run operating system commands with the privileges of the Deno process. This is an inference from the classification and vector, not a tested result.
Affected products and versions
- Deno (product entry Deno Deno): versions before 2.6.8.
- Denoland Deno (product entry Denoland Deno): versions before 2.6.8.
- Fixed version: 2.6.8.
The record lists the two product names as separate entries with the same version boundary.
Exploitation status
The record shows the vulnerability is not listed in the CISA KEV catalog. No confirmed active exploitation or exploitation in the wild appears in the sources consulted. The EPSS probability is 0.03539 (percentile 0.89226), and the SSVC exploitation field is 'poc', which suggests proof-of-concept material may exist; this is not confirmed exploitation. One reference is tagged as exploit-related in the record, and its content was not analyzed here.
Remediation and mitigation
- Upgrade Deno to 2.6.8 or a later release, following the vendor advisory.
- Inventory Deno installations and services, including build pipelines and containers, to find versions before 2.6.8.
- Review code that uses node:child_process and passes data derived from users, requests or files into process execution. Avoid shell-based invocation where it is not required and keep untrusted data out of command strings.
- Run Deno with the minimum permissions needed, so a compromised process has less reach.
- The record does not describe a workaround, so upgrading is the primary remediation.
Detection guidance
- Monitor for child processes spawned by Deno processes, especially shells or unexpected binaries.
- Review application logs for unusual or malformed input on endpoints that trigger process execution.
- Track software inventory to confirm, after patching, which hosts still run versions before 2.6.8.
Limitations of the available information
The record does not identify the specific API calls, shell metacharacters or input conditions involved, and it does not state workaround options. NVD reports a base score of 9.8, while the GitHub-provided scores in the record are 8.1; both are shown here. The content of the exploit-tagged reference was not reviewed. Details that would help build an attack are intentionally omitted.
Frequently asked questions
Which versions are affected?
According to the record, Deno versions before 2.6.8 are affected, and 2.6.8 is the fixed version.
Is this vulnerability known to be exploited in the wild?
The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. The EPSS and SSVC fields suggest some interest in exploitation but do not confirm it.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.