Deno EUVD-2026-90204

Requires all of: (1) the Windows platform - the flaw does not affect Unix-like systems; (2) a Deno version in 2.7.0 through 2.9.7; (3) application code that invokes node:child_process (spawn/exec family) with the shell option enabled, particularly with a shell whose quoting grammar differs from cmd.exe (e.g. PowerShell/pwsh or a custom bash.exe), since Deno wrongly applied cmd.exe escaping to all shells; and (4) attacker influence over the arguments passed to that call. Limiting factors: exploitation depends entirely on a non-default, developer-chosen code pattern (untrusted args + shell option), the target must run on Windows, and the vendor's AC:H/AT:P rating reflects the specific conditions needed - it is not exploitable against a default Deno install that does not shell out with untrusted data.

Signals are moderate, not top-tier. The vendor CVSS 4.0 base score of 9.2 (AV:N/AC:H/AT:P/PR:N/UI:N with full VC/VI/VA:H) looks critical, but three qualifiers pull real-world risk down: it is Windows-ONLY (the 'AV:N' reachability depends on untrusted data reaching a Deno server process), exploitation requires the application to opt into the shell option of node:child_process AND pass attacker-controlled arguments, and the AC:H/AT:P metrics already encode that this is not a point-and-click path. EPSS is not provided, KEV=NO (not in CISA KEV - no evidence of active exploitation), and no public PoC is identified, so exploitation status is: no public exploit identified at time of analysis. The flaw is genuine (a real CWE-78 argument-escaping error confirmed by the PR#36772 diff, which rebuilds quoting per resolved shell grammar via shellGrammarFor), but it is a developer-dependent 'sharp edge' rather than a wormable remote hole. Net: real and patch-worthy for Windows Deno deployments that shell out with untrusted input, but a targeted/conditional issue, not a widespread emergency. Note a data conflict to verify: CVSS marks AV:N while the vulnerable path is local process spawning - 'network' here means the untrusted argument may originate remotely through the hosting app, so treat AV:N as application-context-dependent.

A Windows-hosted Deno web service builds a command from user-supplied input and runs it via child_process with the shell option set (e.g. a non-cmd.exe shell such as PowerShell or bash.exe). Because Deno escapes the argument for cmd.exe syntax rather than the shell that actually parses it, an attacker submits a crafted argument containing shell metacharacters that survive escaping and are reinterpreted as additional commands, yielding arbitrary OS command execution with the Deno process's privileges. No public PoC is known, and the attack requires the Windows platform plus a vulnerable shell-enabled spawn pattern (AC:H/AT:P).