The vulnerability arises from an incomplete blocklist of shell metacharacters in Deno's node:child_process implementation. When an untrusted input can be supplied to the child_process APIs, the attacker can insert shell metacharacters that are not properly filtered, enabling arbitrary shell command execution. This flaw belongs to CWE‑78 and can compromise confidentiality, integrity, and availability of the system if an untrusted payload is executed.

The issue affects the denoland:deno runtime packages that use the node:child_process module. All releases prior to v2.6.8 are vulnerable. The fix was applied in the v2.6.8 release and later versions are considered safe.

The CVSS v3.1 score is 8.1, marking it as high severity. The EPSS score is below 1 %, indicating a low current exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. The attack vector would typically involve an application that spawns shell commands and processes user‑ supplied data. Because child_process is a local API, the attacker would need access to run code in the Deno process, but once inside, arbitrary system commands could be executed.