{"cve":"CVE-2026-32260","nvd":{"published":"2026-03-12T20:16:06.020","modified":"2026-06-17T10:35:26.550","status":"Analyzed","description":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. From 2.7.0 to 2.7.1,  A command injection vulnerability exists in Deno's node:child_process polyfill (shell: true mode) that bypasses the fix for CVE-2026-27190. The two-stage argument sanitization in transformDenoShellCommand (ext/node/polyfills/internal/child_process.ts) has a priority bug: when an argument contains a $VAR pattern, it is wrapped in double quotes (L1290) instead of single quotes. Double quotes in POSIX sh do not suppress backtick command substitution, allowing injected commands to execute. An attacker who controls arguments passed to spawnSync or spawn with shell: true can execute arbitrary OS commands, bypassing Deno's permission system. This vulnerability is fixed in 2.7.2.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-78"],"references":["https://github.com/denoland/deno/security/advisories/GHSA-4c96-w8v2-p28j"],"products":["deno:deno"],"source":"nvd","synced_at":"2026-10-19T22:25:53.701907451+00:00"},"epss":{"cve":"CVE-2026-32260","score":0.01542,"percentile":0.74949,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-4c96-w8v2-p28j","url":"https://osv.dev/vulnerability/GHSA-4c96-w8v2-p28j","summary":"Deno vulnerable to command Injection via incomplete shell metacharacter blocklist in node:child_process","modified":"2026-03-14T09:26:22.452856Z","packages":[{"ecosystem":"crates.io","name":"deno","purl":"pkg:cargo/deno","ranges":[">=2.7.0 <2.7.2"],"fixed":["2.7.2"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}