GHSA-7xh3-mhg9-jcw8 Deno: Command Injection via spawnSync & spawn on Windows

• crates.io deno: < 2.7.10 → fixed in 2.7.10

Summary Deno's `node:child_process` implementation provided an `escapeShellArg()` helper used when callers passed `shell: true` to `spawn` / `spawnSync` / `exec` and friends. On Windows, the helper failed to quote arguments that contained `cmd.exe` metacharacters such as `&`, `|`, ``, `^`, `!`, `(`, `)`, and did not neutralize `%` (which `cmd.exe` expands even inside double-quoted strings). An attacker who controlled any portion of an argument passed to such a call could inject arbitrary additional commands into the spawned `cmd.exe` invocation. This was the Windows counterpart to CVE-2026-27190, which fixed the same class of bug in the Unix branch of `escapeShellArg`. Details On Windows, `child_process` with `shell: true` ran the command via `cmd.exe /d /s /c ""`. Deno assembled that command line by joining the program name and each argument through `escapeShellArg()`. The vulnerable check was: ```ts // If no special characters, return as-is if (!/[\s"\\]/.test(arg)) { return arg; } ``` The regex covered only whitespace, double-quote, and backslash. Any argument containing `cmd.exe`-significant characters but none of those three was returned unquoted and therefore interpreted by the shell. The most straightforward exploit chained commands with `&`: ```js import { spawnSync } from "node:child_process"; spawnSync("echo", ["test&calc.exe"], { shell: true, encoding: "utf-8" }); ``` The reporter confirmed this launched `calc.exe` on Windows 11 with Deno 2.7.5. The same shape worked for `|`, ``, `^`, `!`, `(`, and `)`. A secondary defect existed even when arguments were quoted: `cmd.exe` expands `%FOO%` environment-variable references inside double-quoted strings. Without either doubling `%` or rejecting it, an argument like `"%USERPROFILE%"` leaked environment data into the command line. Proof of concept From the report, run on Windows with Deno ` ^ ! ( ) %`) before passing them to `spawn` / `spawnSync` / `exec`.