8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-49402

CVE-2026-49402: Deno: Command Injection via spawnSync & spawn on Windows

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.10, Deno's node:child_process implementation provided an escapeShellArg() helper used when callers passed shell: true to spawn / spawnSync / exec and friends. On Windows, the helper failed to quote arguments that contained cmd.exe metacharacters and did not neutralize % (which cmd.exe expands even inside double-quoted strings). An attacker who controlled any portion of an argument passed to such a call could inject arbitrary additional commands into the spawned cmd.exe invocation. This vulnerability is fixed in 2.7.10.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-49402

CVE-2026-49402:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
deno	rust	< 2.7.10	2.7.10

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a command injection flaw in Deno's node:child_process module on Windows. The root cause lies in the escapeShellArg function located in ext/node/polyfills/internal/child_process.ts.

When a Deno application uses spawn or spawnSync with the shell: true option on Windows, the arguments are processed by escapeShellArg to be safely passed to cmd.exe. The analysis of the security patch (8b9d1aa92bdab59b117ce85777e20d443d20e905) reveals that the original implementation of escapeShellArg used an incomplete regular expression to detect special characters that require quoting.

The vulnerable code was:

if (!/[\s"\\]/.test(arg)) {
  return arg;
}

This regex only checked for whitespace, double quotes, and backslashes. It missed other critical cmd.exe metacharacters such as &, |, <, >, ^, !, (, and ).

As a result, if an attacker could control an argument passed to spawn or spawnSync, they could include these metacharacters to inject and execute arbitrary commands. For instance, passing an argument like "foo&calc.exe" would result in calc.exe being executed.

The patch fixes this by expanding the regex to include the missing metacharacters:

if (!/[\s"\\&|<>^!()]/.test(arg)) {
  return arg;
}

Therefore, escapeShellArg is the core vulnerable function. During an exploit, a runtime profile or stack trace would show spawn or spawnSync calling this vulnerable escapeShellArg function before executing the injected command.

Vulnerable functions

escapeShellArg

ext/node/polyfills/internal/child_process.ts

The function `escapeShellArg` on Windows was responsible for quoting arguments passed to `cmd.exe` when `shell: true` was used. The original implementation only checked for whitespace, double quotes, and backslashes. It failed to quote arguments containing other `cmd.exe` metacharacters like `&`, `|`, `<`, `>`, `^`, `!`, `(`, `)`, allowing an attacker to inject arbitrary commands. For example, an argument like `"test&calc.exe"` would be passed unquoted, causing `calc.exe` to be executed.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.