CVE-2026-32260

published 2026-03-12

CVE-2026-32260: Deno is a JavaScript, TypeScript, and WebAssembly runtime. From 2.7.0 to 2.7.1, A command injection vulnerability exists in Deno's node:child_process polyfill…

Priority P2 68 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

Deno is a JavaScript, TypeScript, and WebAssembly runtime. From 2.7.0 to 2.7.1, A command injection vulnerability exists in Deno's node:child_process polyfill (shell: true mode) that bypasses the fix for CVE-2026-27190. The two-stage argument sanitization in transformDenoShellCommand (ext/node/polyfills/internal/child_process.ts) has a priority bug: when an argument contains a $VAR pattern, it is wrapped in double quotes (L1290) instead of single quotes. Double quotes in POSIX sh do not suppress backtick command substitution, allowing injected commands to execute. An attacker who controls arguments passed to spawnSync or spawn with shell: true can execute arbitrary OS commands, bypassing Deno's permission system. This vulnerability is fixed in 2.7.2.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
deno	deno	>= 2.7.0 < 2.7.2	2.7.2
deno	deno	>= 2.7.0 < 2.7.2	2.7.2

Detection & IOCs extracted from sources · hover to see the quote

• → Vulnerable code path is in the `transformDenoShellCommand` function within `ext/node/polyfills/internal/child_process.ts`. Monitor for use of `spawn`/`spawnSync` with `shell: true` in Deno environments running versions 2.7.0–2.7.1. ↗
• → Detect backtick command substitution patterns (`` `...` ``) in arguments passed to child_process `spawn`/`spawnSync` with `shell: true` in Deno's node compatibility layer, as double-quote wrapping does not suppress backtick execution in POSIX sh. ↗
• → Alert on child_process calls (`spawnSync` or `spawn`) with `shell: true` where arguments contain `$VAR` patterns, as these trigger the vulnerable double-quote wrapping code path (L1290) instead of safe single-quote wrapping. ↗

• · The vulnerability only manifests when `shell: true` is passed to `spawn` or `spawnSync` in Deno's `node:child_process` polyfill. Calls without `shell: true` are not affected. ↗
• · This is a bypass of the prior fix for CVE-2026-27190; environments that applied the CVE-2026-27190 patch but have not yet upgraded to Deno 2.7.2 remain vulnerable. ↗
• · The priority bug specifically triggers on arguments containing a `$VAR` pattern — these are wrapped in double quotes at L1290 instead of single quotes, making only that subset of arguments exploitable via backtick substitution. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ghsa 9.8 CRITICAL

osv 9.8 CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78