CVE-2026-32260 is a command injection in Deno's node:child_process polyfill, scored 8.1. In shell mode, an argument with a variable pattern was wrapped in double quotes, which still allow command substitution. It bypasses a fix for CVE-2026-27190. Upgrade Deno to 2.7.2 or later.
What's affected
Deno 2.7.0 and 2.7.1. The patched version is 2.7.2.
It affects code that calls spawn or spawnSync from node:child_process with shell set to true and passes user controlled arguments. Code that uses the default, shell off, is not on this path.
Injected commands run at the operating system process level, outside Deno's permission checks. Only the run permission is needed.
How to check if you're exposed
deno --version
Check CI images, container bases and developer machines, since Deno is often installed in several places. Then search your code for the risky pattern.
grep -rn "shell: true" --include="*.ts" --include="*.js" .
Any hit that passes request data, file names or other outside input as arguments needs a closer look, whatever your Deno version.
What to do now
- Upgrade Deno to 2.7.2 or later everywhere you run it.
- Avoid shell: true. Use the default shell off mode and pass arguments as an array.
- If you must use a shell, validate arguments against a strict allowlist first.
- Grant the run permission only to scripts that need it, and scope it to specific binaries.
Why it matters
The class is CWE-78, OS command injection. The advisory describes a two stage quoting scheme with a priority bug. One stage quoted an argument safely with single quotes, a later stage stripped those quotes while parsing, and a third step re-quoted it with double quotes when the text matched a variable pattern. POSIX shells still run backtick substitution inside double quotes, so the argument could carry a command.
This is a regression: an earlier CVE fix was incomplete. Escaping for shells is hard to get right, which is why the safest approach is to avoid shells and pass arguments as a list. The advisory gives the same mitigation.
Whether you are exposed depends on whether your code reaches the risky call with attacker influenced input. A dependency scan tells you which Deno version you have, while reachability analysis helps you tell which findings your code can actually trigger. Safeguard's free in-browser scan at https://gold.safeguard.sh/scan is a good place to start.
The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and no advisory I read says it is exploited in the wild. Treat it as a patch to schedule promptly, not a fire drill, unless your own logs say otherwise.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Am I safe if I never use shell: true?
The advisory describes shell mode as the affected path. Upgrade anyway.
Does Deno's permission system protect me?
The advisory says injected commands run outside it. The run permission is the only one needed.
Sources
Last reviewed: 19 October 2026.
