CVE-2026-103473

Executive Summary

CVE-2026-103473 is a command injection vulnerability in Deno runtime versions 2.7.0 through 2.9.7 on Windows, residing in the node:child_process compatibility module. When the shell option is used, shell arguments are escaped for the wrong shell type, allowing untrusted arguments to be interpreted as OS commands. Successful exploitation yields arbitrary command execution with the privileges of the Deno process, and no public proof-of-concept or vendor patch currently exists.

Technical Analysis

The vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command / OS Command Injection) and carries a CVSS v3.1 base score of 8.1 (High). The attack vector is network-reachable (AV:N) with high attack complexity (AC:H), no required privileges (PR:N), and no user interaction (UI:N). Confidentiality, integrity, and availability impacts are all rated High (C:H/I:H/A:H).

At its core, the flaw stems from a shell-type mismatch in argument escaping within Deno's node:child_process implementation. The node:child_process module is Deno's Node.js compatibility layer that exposes APIs such as child_process.spawn, child_process.exec, and related functions. When a caller passes the shell option, Deno is expected to escape or quote the supplied arguments in a manner appropriate to the shell that will ultimately parse the command string.

On Windows, multiple shells may be involved (for example, cmd.exe versus PowerShell), and each has distinct metacharacter parsing and quoting semantics. The vulnerability arises because Deno escapes arguments for the wrong shell type when the shell option is specified. An argument that is safe under one shell's quoting rules can be interpreted as a command separator or command-substitution construct under another. The result is that an attacker who controls an argument value can break out of the intended argument context and inject arbitrary operating system commands.

The attack surface is any Deno application running on Windows (versions 2.7.0–2.9.7) that uses node:child_process with the shell option and passes attacker-influenced data as an argument. Deno is frequently used to run Node.js-derived code and modern server/edge workloads, so applications that shell out to system utilities while interpolating user input are exposed. Because the escaping logic is intended to neutralize metacharacters but is calibrated for the wrong shell, the neutralization is incomplete for the shell actually in use, enabling injection.

No public exploit, PoC code, Nuclei template, or exploit-in-the-wild evidence is available as of this writing. The technical description above is derived from the CVE record and does not include verified function-level code paths beyond the module and option names stated in the advisory.

Exploitation Scenarios

The following attack chain is described at the vulnerability-class level, consistent with the CVE record. No public PoC is available; the chain is inferred from the command injection class.

1. Reconnaissance / target identification. An attacker identifies a Windows-hosted service or application built on Deno 2.7.0–2.9.7 that invokes node:child_process with the shell option. Exposure is typically a web application, API endpoint, or automation task where a user-supplied value (filename, hostname, search term, parameter) is forwarded as an argument to a shelled child process. Because the attack vector is network (AV:N), remote reachability of such a feature is the primary targeting criterion.

2. Triggering the flaw class. The attacker submits input containing shell metacharacters or command-substitution syntax. Deno escapes the argument using quoting rules for the wrong shell type, so the metacharacters are not neutralized for the shell that ultimately parses the command line. The malformed escaping is the root cause: the value intended to be a single inert argument is instead re-parsed by the shell as an operator or substitution construct.

3. Payload / execution method. Once the escaping boundary is broken, the injected string is interpreted as an OS command and executed by the child shell with the privileges of the Deno process. This is classic command injection — no specific payload syntax is asserted here beyond the class-level behavior, since no verified payload is public. The attacker's objective is to cause the shell to execute an additional command of their choosing instead of (or in addition to) the legitimate intended command.

4. Post-exploitation impact. Because the CVSS impact scores are High across C/I/A, an attacker can read sensitive files and configuration (confidentiality), modify or write data and alter application behavior (integrity), and disrupt or terminate services (availability). Commands run with the Deno process's privileges, so the blast radius equals whatever that process can access — including credentials, secrets, mounted volumes, and any network resources reachable from the host.

Impact Assessment

The CVSS v3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H translates to a base score of 8.1 (High). Network reachability means exploit attempts can originate remotely without local access. The high attack complexity (AC:H) reflects that success depends on application-specific conditions — namely, that a code path passes untrusted input as an argument to node:child_process with the shell option enabled, and that the injected content is parseable by the mismatched shell. No privileges or user interaction are required once those conditions are met.

Scope is Unchanged (S:U), so impact is confined to the vulnerable Deno process's security authority. However, all three impact dimensions are High: full command execution as the Deno process enables credential theft, data tampering, service disruption, and lateral movement opportunities from the compromised host. Affected systems are Windows endpoints and servers running Deno 2.7.0 through 2.9.7 that use the affected module. Non-Windows platforms are outside the stated affected scope. Because no patch is available and no workaround is documented, any qualifying Windows Deno deployment that shells out with untrusted arguments is at elevated risk.

Detection Guidance

Detection should focus on anomalous child-process creation from Deno on Windows, suspicious shell metacharacters in application input, and shell command lines spawned by the Deno binary.

Sigma Rule

title: Suspicious Child Process Spawned by Deno on Windows (CVE-2026-103473)
id: 8f3c1a2e-4b7d-4e91-9c2a-deno103473aa
status: experimental
description: Detects child shell processes spawned by the Deno runtime on Windows, potentially indicating exploitation of command injection in node:child_process (CVE-2026-103473).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-103473
author: valtersit.com
date: 2026/01/01
logsource:
  product: windows
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith:
      - '\deno.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_flags:
    CommandLine|contains:
      - '-c '
      - '/c '
      - '-Command'
      - '&'
      - '|'
      - ';'
  condition: selection_parent and selection_child and selection_flags
falsepositives:
  - Legitimate Deno tooling that intentionally shells out to cmd or PowerShell
level: high
tags:
  - attack.t1059
  - cve.2026.103473

YARA Rule

rule CVE_2026_103473_Deno_ChildProcess_Shell_
{
    meta:
        description = "Detects references to node:child_process shell usage in Deno 2.7.0-2.9.7 related artifacts"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-103473"
        date = "2026-01-01"
        severity = "high"

    strings:
        $mod = "node:child_process" ascii wide nocase
        $shell = "shell" ascii wide
        $denov1 = "2.7." ascii wide
        $denov2 = "2.8." ascii wide
        $denov3 = "2.9." ascii wide

    condition:
        $mod and $shell and 1 of ($denov*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-103473 Deno node:child_process Command Injection Attempt"; flow:established,to_server; content:"shell"; http_client_body; nocase; pcre:"/(\||;|&&|\$\(|`)/"; classtype:attempted-admin; sid:2026103473; rev:1; reference:cve,2026-103473; metadata:service http;)

Elastic Detection

process where event.type == "start" and
process.parent.name == "deno.exe" and
process.name in ("cmd.exe", "powershell.exe", "pwsh.exe") and
process.command_line regex ".*(\\||;|&&|\\$\\(|`).*"

Splunk SPL Query

index=windows EventCode=4688
(New_Process_Name="*\\cmd.exe" OR New_Process_Name="*\\powershell.exe" OR New_Process_Name="*\\pwsh.exe")
Parent_Process_Name="*\\deno.exe"
(Process_Command_Line="*-c *" OR Process_Command_Line="*/c *" OR Process_Command_Line="*-Command*" OR Process_Command_Line="*|*" OR Process_Command_Line="*;*")
| stats count min(_time) as first_seen max(_time) as last_seen by ComputerName, Parent_Process_Name, New_Process_Name, Process_Command_Line
| sort - count

Wazuh OSSEC Rule

<group name="windows,deno,cve-2026-103473,">
  <rule id="1034730" level="12">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.parentImage">\\deno\.exe$</field>
    <field name="win.eventdata.image">\\(cmd|powershell|pwsh)\.exe$</field>
    <description>CVE-2026-103473: Possible Deno command injection - child shell spawned by deno.exe</description>
    <mitre>
      <id>T1059</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Avoid passing untrusted input as arguments to node:child_process calls that enable the shell option. Where possible, invoke child processes without a shell and pass arguments as an array so the OS does not re-parse a command string. If a shell is unavoidable, validate and allowlist input against a strict pattern, and avoid interpolating user-controlled values into command strings. Consider restricting which features accept externally supplied values on affected Windows Deno services. Until a fix ships, treat Deno 2.7.0–2.9.7 on Windows as untrusted for any code path that shells out with attacker-influenced arguments.

2. Patch/upgrade steps. No official patch or fixed version is identified in tracked sources. Monitor the Deno project for an advisory and upgrade to the first release that corrects the shell-escaping logic once published. Because patch confidence is 0/4, do not assume any current 2.7.0–2.9.7 release is remediated. If a patched version becomes available, validate the fix in a staging environment and redeploy across affected Windows hosts.

3. Long-term hardening. Remove unnecessary shell execution from Deno applications; prefer non-shell process invocation APIs. Apply least privilege to the Deno process so that even successful injection yields limited impact. Enable process-creation auditing (e.g., Windows Event ID 4688) and forward logs to a SIEM with the detection rules above. Maintain an inventory of Deno versions across Windows fleets to rapidly identify exposure when a fix is released.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-103473
• CWE-78 — Improper Neutralization of Special Elements used in an OS Command: https://cwe.mitre.org/data/definitions/78.html
• MITRE ATT&CK T1059 — Command and Scripting Interpreter: https://attack.mitre.org/techniques/T1059/
• Deno Runtime (project site / security advisories): https://deno.com
• FIRST EPSS — not yet scored for this CVE: https://www.first.org/epss

No known threat actor campaigns or exploit-in-the-wild evidence are associated with this CVE at the time of writing; it is not listed in CISA KEV.