What is the CVSS score of CVE-2026-32260?

CVE-2026-32260 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Deno are affected by CVE-2026-32260?

A critical command injection vulnerability in Deno versions 2.7.0-2.7.1 allows attackers to execute arbitrary commands when shell mode is enabled in child process operations, potentially compromising…. A patch is available.

How to fix or mitigate CVE-2026-32260?

Within 24 hours: Inventory all Deno deployments and identify systems running versions 2.7.0-2.7.1, particularly those using node:child_process with shell: true. Within 7 days: Implement network-level access controls to restrict outbound connections from Deno runtime processes and disable shell mode in child_process calls where operationally feasible through code review and remediation. Within 30 days: Upgrade to Deno 2.7.2 or later once the patch is released, or migrate critical applications to alternative runtimes if patch availability remains uncertain.

Deno CVE-2026-32260

EUVD-2026-11694 HIGH

OS Command Injection (CWE-78)

2026-03-12 security-advisories@github.com

GHSA-4c96-w8v2-p28j

Command Injection Deno Suse

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 12, 2026 - 22:55 euvd

EUVD-2026-11694

Analysis Generated

Mar 12, 2026 - 22:55 vuln.today

CVE Published

Mar 12, 2026 - 20:16 nvd

HIGH 8.1

DescriptionGitHub Advisory

Deno is a JavaScript, TypeScript, and WebAssembly runtime. From 2.7.0 to 2.7.1, A command injection vulnerability exists in Deno's node:child_process polyfill (shell: true mode) that bypasses the fix for CVE-2026-27190. The two-stage argument sanitization in transformDenoShellCommand (ext/node/polyfills/internal/child_process.ts) has a priority bug: when an argument contains a $VAR pattern, it is wrapped in double quotes (L1290) instead of single quotes. Double quotes in POSIX sh do not suppress backtick command substitution, allowing injected commands to execute. An attacker who controls arguments passed to spawnSync or spawn with shell: true can execute arbitrary OS commands, bypassing Deno's permission system. This vulnerability is fixed in 2.7.2.

AnalysisAI

Deno versions 2.7.0 through 2.7.1 contain a command injection vulnerability in the node:child_process polyfill where improper quote handling allows attackers to bypass previous security fixes and execute arbitrary OS commands through shell metacharacter injection in spawn/spawnSync arguments. This vulnerability bypasses Deno's permission system entirely, enabling complete system compromise for applications processing untrusted input. A patch is available in version 2.7.2.

Technical ContextAI

Classified as CWE-78 (OS Command Injection). Deno is a JavaScript, TypeScript, and WebAssembly runtime. From 2.7.0 to 2.7.1, A command injection vulnerability exists in Deno's node:child_process polyfill (shell: true mode) that bypasses the fix for CVE-2026-27190. The two-stage argument sanitization in transformDenoShellCommand (ext/node/polyfills/internal/child_process.ts) has a priority bug: when an argument contains a $VAR pattern, it is wrapped in double quotes (L1290) instead of single quotes. Double quotes in POSIX sh do not suppres