CVE-2026-103473

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-103473
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103473.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-103473
Published
2026-09-30T17:22:40Z
Modified
2026-10-02T03:47:01Z
Severity
  • 9.2 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Deno 2.7.0 through 2.9.7 Command Injection via node:child_process
Details

Deno versions 2.7.0 through 2.9.7 on Windows contain a command injection vulnerability in node:child_process where shell arguments are escaped for the wrong shell type. Attackers can inject OS commands by passing untrusted arguments with the shell option, allowing arbitrary command execution with Deno process privileges.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-78"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103473.json"
}
References

Affected packages

Git / github.com/denoland/deno

Affected ranges

Type
GIT
Repo
https://github.com/denoland/deno
Events
Introduced
fb4db333c37ec1242a6f80738510d214018fea53
Fixed
0c071246a412575e07423263404a5d13e7ed6aa2
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "2.7.0"
        },
        {
            "last_affected":  "2.9.7"
        },
        {
            "fixed":  "2.9.7"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

v2.*
v2.7.0
v2.7.1
v2.7.10
v2.7.11
v2.7.12
v2.7.13
v2.7.14
v2.7.2
v2.7.3
v2.7.4
v2.7.5
v2.7.6
v2.7.7
v2.7.8
v2.7.9
v2.8.0
v2.8.1
v2.8.2
v2.8.3
v2.9.0
v2.9.1
v2.9.2
v2.9.3
v2.9.4
v2.9.5
v2.9.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103473.json"