A command injection flaw resides in Deno 2.7.0 through 2.7.1’s node:child_process polyfill when shell execution is enabled. The sanitization routine improperly wraps $VAR patterns in double quotes rather than single quotes, permitting backtick command substitution in POSIX sh. An attacker who can influence arguments supplied to spawnSync or spawn with shell:true can execute arbitrary operating‑system commands, effectively bypassing Deno’s permission system. This weakness represents a classic command injection (CWE-78) and can compromise confidentiality, integrity, and availability of the host system.

The vulnerability affects the denoland:deno product specifically versions 2.7.0 and 2.7.1. Versions 2.7.2 and later contain the fix and are not impacted.

The CVSS rating of 8.1 classifies the flaw as high severity. EPSS indicates the likelihood of exploitation is 1%, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is local to the process but could be expanded to remote contexts if the application is exposed. Exploitability requires an attacker to control input to the child_process API; no public exploitation or proof‑of‑concept material is cited; however, the flaw’s high impact warrants immediate attention.