The vulnerability lies in the node:child_process polyfill in Deno 2.7.0 through 2.9.7 on Windows. The library escapes shell arguments for a different shell type, enabling attackers to inject arbitrary OS commands when they supply untrusted arguments to the shell option. This flaw allows an attacker to execute code with the same privileges as the running Deno process, leading to full system compromise.

The impacted software is Deno by denoland, specifically Windows builds with versions 2.7.0 to 2.9.7. No other operating systems or product variants were noted in the listing. Users running Deno releases on Windows must check their installation.

The CVSS score of 9.2 indicates a severe risk. The EPSS score is 1.471% and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a malicious script or module that invokes child_process with the shell option on a Windows machine. Successful exploitation grants the attacker arbitrary command execution with Deno process privileges, potentially compromising the host system.