Deno Command Injection Vulnerability in Child Process Module

A command injection vulnerability has been identified in Deno versions prior to 2.6.8, specifically within the 'node:child_process' module. The issue arises from an incomplete blocklist of shell metacharacters, which could be exploited to execute arbitrary commands.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the host system.

Reproduction

The vulnerability can be reproduced by using 'spawnSync' from the 'node:child_process' module to execute a Deno command with injected shell metacharacters, such as newlines or semicolons, which are not properly escaped. This can be done by crafting a payload that, when executed, performs unintended actions, such as creating a file as proof of command execution.

Remediation

Users are advised to update Deno to version 2.6.8 or later, where this vulnerability has been patched.