High severity8.1NVD Advisory· Published Sep 30, 2026· Updated Sep 30, 2026
CVE-2026-103473
CVE-2026-103473
Description
Deno versions 2.7.0 through 2.9.7 on Windows contain a command injection vulnerability in node:child_process where shell arguments are escaped for the wrong shell type. Attackers can inject OS commands by passing untrusted arguments with the shell option, allowing arbitrary command execution with Deno process privileges.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
4- github.com/denoland/deno/blob/0c071246a412575e07423263404a5d13e7ed6aa2/ext/node/polyfills/internal/child_process.tsnvd
- github.com/denoland/deno/blob/0c071246a412575e07423263404a5d13e7ed6aa2/ext/node/polyfills/internal/child_process.tsnvd
- github.com/denoland/deno/pull/36772nvd
- www.vulncheck.com/advisories/deno-2.7.0-through-2.9.7-command-injection-via-node-child-processnvd
News mentions
0No linked articles in our index yet.