CyberRota Analysis
AI-GeneratedDeno versions 2.7.0 through 2.9.7 on Windows are vulnerable to a command injection flaw in the node:child_process module, which improperly escapes shell arguments for the wrong shell type. This vulnerability allows attackers to execute arbitrary OS commands by supplying untrusted arguments, potentially compromising the system with the same privileges as the Deno process. Organizations using affected Deno versions on Windows should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Deno versions 2.7.0 through 2.9.7 on Windows contain a command injection vulnerability in node:child_process where shell arguments are escaped for the wrong shell type. Attackers can inject OS commands by passing untrusted arguments with the shell option, allowing arbitrary command execution with Deno process privileges.