What is the CVSS score of CVE-2026-27190?

CVE-2026-27190 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.8%.

Which versions of Deno are affected by CVE-2026-27190?

A critical command injection vulnerability in Deno's child_process implementation (CVE-2026-27190, CVSS 8.1) poses a significant risk to organizations running Deno applications, allowing attackers to…. A patch is available.

Is there a public PoC exploit available for CVE-2026-27190?

Yes, a public proof-of-concept exploit is available for CVE-2026-27190. Prioritise patching immediately. EPSS: 0.8%.

How to fix or mitigate CVE-2026-27190?

Within 24 hours: Inventory all systems running Deno versions prior to 2.6.8 and assess exposure in development, testing, and production environments. Within 7 days: Apply Deno patch 2.6.8 or later across all affected systems, beginning with production systems running untrusted or user-supplied input. Within 30 days: Complete patching of all remaining instances, validate application functionality post-patch, and review application code for unsafe child_process usage patterns.

Deno CVE-2026-27190

HIGH

OS Command Injection (CWE-78)

2026-02-20 security-advisories@github.com

GHSA-hmh4-3xvx-q5hr

Command Injection Deno Suse

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:04 vuln.today

PoC Detected

Mar 02, 2026 - 13:35 vuln.today

Public exploit code

Patch released

Mar 02, 2026 - 13:35 nvd

Patch available

CVE Published

Feb 20, 2026 - 21:19 nvd

HIGH 8.1

DescriptionGitHub Advisory

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.6.8, a command injection vulnerability exists in Deno's node:child_process implementation. This vulnerability is fixed in 2.6.8.

AnalysisAI

Command injection in Deno versions prior to 2.6.8 allows unauthenticated remote attackers to execute arbitrary commands through the node:child_process implementation. Public exploit code exists for this vulnerability, which carries a CVSS score of 8.1 and affects the confidentiality, integrity, and availability of affected systems. Users should upgrade to Deno 2.6.8 or later to remediate this risk.

Technical ContextAI

Classified as CWE-78 (OS Command Injection). Affects Deno. Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.6.8, a command injection vulnerability exists in Deno's node:child_process implementation. This vulnerability is fixed in 2.6.8.