CVE-2026-27190: Command Injection in Deno node:child_process

CVE-2026-27190 is a high severity (CVSS 8.1) command injection in the node:child_process implementation of Deno before version 2.6.8. Deno 2.6.8 fixes it. Upgrade the runtime everywhere it runs, and check any code that passes outside input to child process functions.

What's affected

Deno versions before 2.6.8. The record gives few details beyond the component, node:child_process, and the fix version. Deno 2.6.8 contains the fix.

How to check if you're exposed

deno --version

Anything below 2.6.8 is affected. Check CI images, containers and developer machines, since the runtime is often pinned in several places. Then search your code for imports of node:child_process and for exec or spawn calls that include request data.

What to do now

1. Upgrade Deno to 2.6.8 or later everywhere it runs.
2. Update container base images and CI runners that install Deno.
3. Search for node:child_process use and check what feeds its arguments.
4. Prefer spawn with an argument array over building command strings.
5. Run the Deno permissions model with run access scoped to the commands you need.

Why it matters

The weakness is CWE-78, OS command injection. The details in the record are brief, and the sound approach is to read the Deno advisory GHSA-hmh4-3xvx-q5hr for specifics. Runtimes reimplement familiar APIs such as child_process, and a gap in one of them reaches every application that uses it.

A runtime fix helps only after you upgrade the runtime, so a version inventory of deployed Deno binaries is the first step. The record does not mark this CVE as known exploited.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• CVE-2026-27190 on Gold
• Release listed in the record: https://github.com/denoland/deno/releases/tag/v2.6.8
• GitHub advisory listed in the record: https://github.com/denoland/deno/security/advisories/GHSA-hmh4-3xvx-q5hr

Last reviewed: 19 October 2026.