CVE-2026-32260 - Vulnerability Analysis

Overview

Deno 2.7.0 to 2.7.1 contains a command injection caused by improper argument sanitization in node:child_process polyfill shell mode, letting attackers execute arbitrary OS commands bypassing permission system, exploit requires control over spawn arguments.

Severity & Score

Impact

Attackers can execute arbitrary OS commands, bypassing permission controls and compromising the system.

Mitigation

Update to version 2.7.2 or later.

References

• https://github.com/denoland/deno/security/advisories/GHSA-4c96-w8v2-p28j

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 12, 2026

🟠 CVE-2026-32260 - High (8.1) Deno is a JavaScript, TypeScript, and WebAssembly runtime. From 2.7.0 to 2.7.1, A command injection vulnerability exists in Deno's node:child_process polyfill (shell: true mode) that bypasses the fix for CVE-2026-27190. The two-stage argument san... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32260/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner