{"id":"EUVD-2026-38546","enisaUuid":"ed5fa67e-a6d5-3635-bb4c-194262ee07be","description":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.10, Deno\u0027s node:child_process implementation provided an escapeShellArg() helper used when callers passed shell: true to spawn / spawnSync / exec and friends. On Windows, the helper failed to quote arguments that contained cmd.exe metacharacters and did not neutralize % (which cmd.exe expands even inside double-quoted strings). An attacker who controlled any portion of an argument passed to such a call could inject arbitrary additional commands into the spawned cmd.exe invocation. This vulnerability is fixed in 2.7.10.","datePublished":"Jun 23, 2026, 5:20:50 PM","dateUpdated":"Jun 25, 2026, 3:55:49 AM","baseScore":8.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/denoland/deno/security/advisories/GHSA-7xh3-mhg9-jcw8\n","aliases":"CVE-2026-49402\nGHSA-7xh3-mhg9-jcw8\n","assigner":"GitHub_M","epss":0.45,"enisaIdProduct":[{"id":"46132617-1ca0-3408-830a-fe9b89a4a5c9","product":{"name":"deno","vendor":{"name":"denoland"}},"product_version":"\u003c 2.7.10"}],"enisaIdVendor":[{"id":"0c940eab-bd35-3015-98fa-fabf724dedb1","vendor":{"name":"denoland"}}],"enisaIdVulnerability":[{"id":"124eb75f-ef05-3e77-987d-2606f003b681","vulnerability":{"id":"CVE-2026-49402","description":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.10, Deno\u0027s node:child_process implementation provided an escapeShellArg() helper used when callers passed shell: true to spawn / spawnSync / exec and friends. On Windows, the helper failed to quote arguments that contained cmd.exe metacharacters and did not neutralize % (which cmd.exe expands even inside double-quoted strings). An attacker who controlled any portion of an argument passed to such a call could inject arbitrary additional commands into the spawned cmd.exe invocation. This vulnerability is fixed in 2.7.10.","datePublished":"Jun 23, 2026, 5:20:50 PM","dateUpdated":"Jun 25, 2026, 3:55:49 AM","status":"PUBLISHED","baseScore":8.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/denoland/deno/security/advisories/GHSA-7xh3-mhg9-jcw8\n","enisa_id":"EUVD-2026-38546\n","assigner":"GitHub_M","epss":0.45,"dataProcessed":"Nov 3, 2026, 7:18:48 AM","vulnerabilityProduct":[{"id":"57080135-110f-3857-b6ac-3edf43cc9d0e","product":{"name":"deno","vendor":{"name":"denoland"}},"product_version":"\u003c 2.7.10"}],"vulnerabilityVendor":[{"id":"f8af1a82-327c-3d81-b9c5-5b6aaf212d9c","vendor":{"name":"denoland"}}]}},{"id":"649ecee6-db73-3cff-adcc-85bc7f821b9e","vulnerability":{"id":"GHSA-7xh3-mhg9-jcw8","description":"Deno: Command Injection via spawnSync \u0026 spawn on Windows","datePublished":"Jun 16, 2026, 7:07:44 PM","dateUpdated":"Jul 20, 2026, 9:01:31 PM","baseScore":0.0,"references":"https://github.com/denoland/deno/security/advisories/GHSA-7xh3-mhg9-jcw8\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-49402\nhttps://github.com/denoland/deno\n","enisa_id":"EUVD-2026-38546\n","aliases":"GHSA-7xh3-mhg9-jcw8\nCVE-2026-49402\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}