-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| deno | rust | < 2.5.2 | 2.5.2 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in how Deno's Deno.Command.spawn() and node:child_process.spawn() APIs handle file execution on Windows. The root cause is that when a batch file (.bat or .cmd) is executed, the Windows CreateProcess() function implicitly involves cmd.exe, which can lead to command injection if arguments are not properly sanitized. The provided patch addresses this by explicitly disallowing the direct execution of .bat and .cmd files within the compute_run_cmd_and_check_permissions function in ext/process/lib.rs. This function is a key part of the command execution pipeline, and the added check prevents the vulnerability from being triggered. The test file tests/unit/command_test.ts was also updated with a new test case, rejectBatAndCmdFiles, to verify the fix. Therefore, the compute_run_cmd_and_check_permissions function is the precise location of the vulnerable code.
Ongoing coverage of React2Shell