CVE-2026-32260: Deno Runtime RCE Vulnerability

CVE-2026-32260 Overview

CVE-2026-32260 is a command injection vulnerability affecting Deno, a JavaScript, TypeScript, and WebAssembly runtime. The vulnerability exists in Deno's node:child_process polyfill when operating in shell: true mode. This flaw bypasses the security fix implemented for CVE-2026-27190, allowing attackers to execute arbitrary operating system commands by exploiting a priority bug in the two-stage argument sanitization process within the transformDenoShellCommand function.

Critical Impact

Attackers who control arguments passed to spawnSync or spawn with shell: true can execute arbitrary OS commands, completely bypassing Deno's permission system and potentially achieving full system compromise.

Affected Products

• Deno versions 2.7.0 to 2.7.1

Discovery Timeline

• 2026-03-12 - CVE-2026-32260 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-32260

Vulnerability Analysis

This command injection vulnerability (CWE-78) stems from a subtle but critical flaw in how Deno sanitizes command-line arguments in its Node.js compatibility layer. The vulnerability specifically affects the transformDenoShellCommand function located in ext/node/polyfills/internal/child_process.ts.

When processing arguments that contain shell variable patterns (such as $VAR), the sanitization logic at line 1290 wraps these arguments in double quotes rather than single quotes. This creates a significant security gap because in POSIX shell environments, double quotes do not suppress backtick command substitution.

As a result, an attacker can craft malicious input containing backtick-enclosed commands that will be executed by the underlying shell, even though the argument appears to be safely quoted. This effectively allows the attacker to break out of Deno's permission sandbox and execute arbitrary commands with the privileges of the Deno process.

Root Cause

The root cause is a priority bug in the argument sanitization logic. The code checks for $VAR patterns before applying proper escaping, and when such patterns are detected, it incorrectly uses double quotes for wrapping. In POSIX-compliant shells, double quotes allow certain expansions including backtick command substitution (\command``), whereas single quotes would treat the content as a literal string. This oversight allows the CVE-2026-27190 fix to be bypassed.

Attack Vector

The attack vector requires network access but involves high complexity. An attacker must be able to influence the arguments passed to spawnSync() or spawn() functions when shell: true is enabled. This could occur in web applications or services that construct shell commands using user-supplied input, such as:

• Web applications that execute system commands based on user input
• Build tools or CI/CD pipelines processing untrusted repository content
• Server-side JavaScript applications that shell out to system utilities

The vulnerability allows exploitation without any privileges or user interaction, making it particularly dangerous in automated or headless environments.

Detection Methods for CVE-2026-32260

Indicators of Compromise

• Unexpected child processes spawned by Deno applications
• Unusual system commands or processes initiated from the Deno runtime context
• Log entries showing shell command execution with suspicious backtick patterns in arguments
• Network connections or file system modifications originating from processes spawned by Deno

Detection Strategies

• Monitor Deno application logs for calls to spawnSync or spawn with shell: true and arguments containing both $ patterns and backticks
• Implement application-level input validation to detect and reject arguments containing shell metacharacters
• Use process monitoring to detect unexpected command execution chains originating from Deno processes
• Deploy runtime application self-protection (RASP) solutions that can detect command injection attempts

Monitoring Recommendations

• Enable verbose logging for Deno applications in production to capture child process invocations
• Set up alerts for any shell command execution involving string concatenation with user input
• Monitor for anomalous process trees where Deno spawns unexpected child processes
• Review application code for patterns where external input flows into child_process functions

How to Mitigate CVE-2026-32260

Immediate Actions Required

• Upgrade Deno to version 2.7.2 or later immediately
• Audit all code using node:child_process with shell: true for potential exposure to user-controlled input
• Consider disabling shell: true mode where possible and use direct process execution instead
• Implement strict input validation and sanitization for any data that may be passed to shell commands

Patch Information

Deno has released version 2.7.2 which contains the official fix for this vulnerability. The patch corrects the argument quoting logic in transformDenoShellCommand to properly use single quotes when handling arguments containing variable patterns, preventing backtick command substitution. For detailed information, refer to the GitHub Security Advisory.

Workarounds

• Avoid using shell: true when spawning child processes; use direct process execution with explicit argument arrays instead
• Implement a strict allowlist for any user-supplied values that must be passed to shell commands
• Use Deno's built-in command execution APIs that don't involve shell interpretation when possible
• Deploy application firewalls or input validation middleware to filter shell metacharacters from user input before processing

# Verify Deno version and upgrade if necessary
deno --version
# If version is 2.7.0 or 2.7.1, upgrade immediately:
deno upgrade --version 2.7.2