Deno 2.7.0 through 2.9.7 Command Injection via node:child_process

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-103473 · Microsoft / collected KEV context

cve-program · CVE-2026-103473

• https://github.com/denoland/deno/pull/36772
• https://github.com/denoland/deno
• https://github.com/denoland/deno/blob/0c071246a412575e07423263404a5d13e7ed6aa2/ext/node/polyfills/internal/child_process.ts#L1499
• https://github.com/denoland/deno/blob/0c071246a412575e07423263404a5d13e7ed6aa2/ext/node/polyfills/internal/child_process.ts#L1339
• https://www.vulncheck.com/advisories/deno-2.7.0-through-2.9.7-command-injection-via-node-child-process

No related operational record is retained in the current change model.