8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27190

CVE-2026-27190: Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.6.8, a command injection vulnerability exists in Deno's node:child_process implementation. This vulnerability is fixed in 2.6.8.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27190

CVE-2026-27190:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
deno	rust	< 2.6.8	2.6.8

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a command injection in Deno's implementation of the node:child_process module, specifically affecting functions like spawn and spawnSync when used with the shell: true option. The root cause is the improper handling of arguments passed to these functions.

The analysis of the patch commit 9132ad958c83a0d0b199de12b69b877f63edab4c reveals two key functions involved in the vulnerability:

normalizeSpawnArguments: This internal function constructs the final command string to be executed by the shell. The vulnerable version of this function directly concatenated arguments into the command string without escaping them. This allowed malicious input containing shell metacharacters (e.g., newlines) to be interpreted as separate commands by the shell.
transformDenoShellCommand: This function was intended to act as a security check by scanning for shell metacharacters. However, its detection regex was incomplete and failed to account for newline and carriage return characters, which are valid command separators in shell environments. This allowed the injection to succeed.

An attacker exploiting this vulnerability would cause these functions to process a malicious argument, leading to the execution of arbitrary commands on the underlying system. Therefore, normalizeSpawnArguments and transformDenoShellCommand are the primary functions that would appear in a runtime profile during exploitation.

Vulnerable functions

normalizeSpawnArguments

ext/node/polyfills/internal/child_process.ts

This function is responsible for preparing the command and arguments for execution. The vulnerability lies in the handling of the `shell: true` option. Previously, the function would concatenate the command (`file`) and its arguments (`args`) with a space, without any escaping. This allowed an attacker to inject shell metacharacters (like newlines, semicolons, etc.) into the arguments, leading to arbitrary command execution. The vulnerable code was `let command = ArrayPrototypeJoin([file, ...args], " ");`.

transformDenoShellCommand

ext/node/polyfills/internal/child_process.ts

This function inspects arguments for shell metacharacters to prevent injection. However, the original implementation had an incomplete blocklist that missed newline (`\n`) and carriage return (`\r`) characters. This allowed an attacker to bypass the check and inject new commands, as demonstrated in the vulnerability's proof-of-concept.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.