Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process

Summary A command injection vulnerability exists in Deno's node:childprocess implementation. Reproduction javascript import spawnSync from "node:childprocess"; import as fs from "node:fs"; // Cleanup try fs.unlinkSync'/tmp/rceproof'; catch // Create legitimate script...

PT-2026-20983

Name of the Vulnerable Software and Affected Versions Deno versions prior to 2.6.8 Description A command injection issue exists in Deno's node:child process implementation. The issue allows for arbitrary command execution through crafted input provided to the spawnSync function when the shell...

Malicious code in node-child (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 280a54ba81116fa296951b2b9431a78d1055fa15886fb848a98707ec9be36994 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4878 Malicious code in node-child (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 280a54ba81116fa296951b2b9431a78d1055fa15886fb848a98707ec9be36994 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...