{"id":"CVE-2026-32260","aliases":["GHSA-4c96-w8v2-p28j"],"url":"https://o3.security/vulnerability/CVE-2026-32260","summary":"Command Injection via incomplete shell metacharacter blocklist in node:child_process (bypass of CVE-2026-27190 fix)","details":"## Summary\n\n  A command injection vulnerability exists in Deno's `node:child_process` polyfill (`shell: true` mode) that bypasses the fix\n  for CVE-2026-27190 (GHSA-hmh4-3xvx-q5hr). An attacker who controls arguments passed to `spawnSync` or `spawn` with `shell:\n  true` can execute arbitrary OS commands, bypassing Deno's permission system.\n\n  **Affected versions:** Deno v2.7.0, v2.7.1\n\n  ## Details\n\n  The two-stage argument sanitization in `transformDenoShellCommand` (`ext/node/polyfills/internal/child_process.ts`) has a\n  priority bug: when an argument contains a `$VAR` pattern, it is wrapped in double quotes (L1290) instead of single quotes\n  (L1293). Double quotes in POSIX sh do not suppress backtick command substitution, allowing injected commands to execute.\n\n  Attack chain:\n  1. `escapeShellArg` wraps the argument in single quotes (safe)\n  2. `op_node_parse_shell_args` strips the single-quote delimiters during tokenization (raw argument exposed)\n  3. Re-quoting detects `$VAR` pattern → applies double quotes\n  4. Backtick payload inside double quotes executes via `/bin/sh`\n\n  ## Impact\n\n  **OS Command Injection (CWE-78)**. Any application using `node:child_process` `spawn`/`spawnSync` with `shell: true` and\n  user-controlled arguments is vulnerable. Injected commands execute at the OS process level, outside Deno's permission\n  sandbox. Only `--allow-run` is required.\n\n  ## Mitigation\n\n  Avoid passing user-controlled input as arguments to `spawn`/`spawnSync` with `shell: true`. Use `shell: false` (the default)\n  instead, or validate/sanitize inputs before passing them.","published":"2026-03-12T19:41:17.965Z","modified":"2026-08-12T03:51:44.811254376Z","cvss":{"score":8.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"score":0.01483,"percentile":0.72713,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"deno","fixedVersion":"2.7.2"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32260.json"},{"type":"ADVISORY","url":"https://github.com/denoland/deno/security/advisories/GHSA-4c96-w8v2-p28j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32260"},{"type":"PACKAGE","url":"https://github.com/denoland/deno"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:44.811254376Z"}}