A command injection flaw resides in Deno 2.7.0 through 2.7.1’s node:child_process polyfill when shell execution is enabled. The sanitization routine improperly wraps $VAR patterns in double quotes rather than single quotes, permitting backtick command substitution in POSIX sh. An attacker who can influence arguments supplied to spawnSync or spawn with shell:true can execute arbitrary operating‑system commands, effectively bypassing Deno’s permission system. This weakness represents a classic command injection (CWE-78) and can compromise confidentiality, integrity, and availability of the host system.

The vulnerability affects the denoland:deno product specifically versions 2.7.0 and 2.7.1. Versions 2.7.2 and later contain the fix and are not impacted.

The CVSS rating of 8.1 classifies the flaw as high severity. EPSS indicates the likelihood of exploitation is below 1%, and the vulnerability is not listed in the CISA KEV catalog. Exploitability requires an attacker to control input to the child_process API; in contexts where application code accepts untrusted data, the attack vector is local to the process but could be leveraged remotely if the application is exposed. No public exploitation or proof‑of‑concept material is cited; however, the flaw’s high impact warrants immediate attention.