Loading story…
A high-severity vulnerability, tracked as CVE-2025-61787, was identified in Deno, a runtime for JavaScript, TypeScript, and WebAssembly. The flaw specifically affects Windows systems and allows for command injection when batch files are executed. The vulnerability arises because, on Windows, the CreateProcess() function implicitly invokes cmd.exe when executing batch files, even if the application does not explicitly specify it. This behavior enables attackers to inject arbitrary commands if they can influence the batch file execution process. Deno versions prior to 2.5.3 and 2.2.15 are confirmed to be vulnerable to this issue. The vulnerability is remotely exploitable, increasing the risk for systems running affected Deno versions on Windows. Security advisories highlight that the issue is fixed in Deno versions 2.5.3 and 2.2.15, and users are urged to upgrade to these or later versions to mitigate the risk. The vulnerability was disclosed publicly in early October 2025, and its high CVSS score of 8.1 reflects the significant risk it poses. The flaw could potentially allow attackers to execute arbitrary commands with the privileges of the Deno process, leading to system compromise or further lateral movement. The vulnerability does not appear to affect non-Windows platforms, as the underlying issue is tied to Windows-specific process creation behavior. No reports of active exploitation have been confirmed at the time of disclosure, but the remote exploitability and ease of triggering the flaw make it a priority for patching. The Deno development team responded promptly by releasing patched versions and providing detailed advisories to the community. Organizations using Deno in production on Windows are strongly advised to audit their deployments and ensure all instances are updated. Security teams should also review application logic to ensure that untrusted input cannot influence batch file execution. The vulnerability underscores the importance of understanding platform-specific behaviors in cross-platform runtimes. Deno's maintainers have also recommended additional security best practices for users who cannot immediately upgrade. The disclosure has prompted broader discussions about secure process execution and command injection risks in modern runtimes.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2025-61787 was publicly disclosed as a high-severity remotely exploitable command injection flaw affecting Deno on Windows during batch file execution. Public reporting identified affected versions prior to 2.5.3 and 2.2.15 and recommended updating to the fixed releases.
Deno addressed a command injection vulnerability on Windows related to executing .bat and .cmd files, caused by CreateProcess() implicitly invoking cmd.exe. The fix was released in Deno versions 2.5.3 and 2.2.15, with prior versions affected.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Deno disclosed a high-severity command injection vulnerability in its Windows implementation of `node:child_process`, where the `escapeShellArg()` helper failed to safely handle `cmd.exe` metacharacters such as `&`, `|`, `<`, `>`, `^`, `!`, `(`, `)`, and `%`. When applications used `shell: true` with `spawn`, `spawnSync`, `exec`, and related APIs, attacker-controlled input could break out of the intended argument context and execute arbitrary commands in the security context of the Deno process. A proof of concept showed `calc.exe` launching on Windows 11 after a crafted argument was passed to `spawnSync`. The issue is tracked as **CVE-2026-49402** and affects Deno versions prior to **2.7.10** on Windows. The flaw is considered the Windows counterpart to **CVE-2026-27190**, which addressed the same bug class on Unix-like systems. Deno said deployments are not affected when `shell: true` is not used, and advised users to upgrade to **2.7.10** and avoid passing untrusted input into shelled subprocess calls.
Jun 29, 2026
A critical DLL hijacking vulnerability, tracked as CVE-2025-56383, was discovered in Notepad++, a widely used text editor. Security researchers identified that the flaw allows attackers to execute arbitrary code on affected systems by exploiting the way Notepad++ loads dynamic link libraries (DLLs). The vulnerability arises when Notepad++ searches for and loads DLL files from directories that can be controlled by an attacker, enabling the introduction of malicious code. Proof-of-concept (PoC) exploit code has been made publicly available, increasing the risk of exploitation by threat actors. The public release of the PoC has heightened concerns within the cybersecurity community, as it lowers the barrier for attackers to leverage this flaw in real-world attacks. The vulnerability is considered severe due to the widespread use of Notepad++ in both personal and enterprise environments. Security advisories have urged users and organizations to apply available patches or implement mitigation strategies to prevent exploitation. The flaw is actively being discussed in security forums, with experts warning that unpatched systems are at significant risk. The technical details of the exploit demonstrate that attackers can gain the same privileges as the user running Notepad++, potentially leading to full system compromise. Security professionals recommend monitoring for suspicious activity related to DLL loading in Notepad++ installations. The vulnerability has been assigned a CVE identifier, underscoring its recognition by the broader security industry. Organizations are advised to review their software inventories to identify vulnerable Notepad++ installations. The availability of the PoC may lead to an increase in automated attacks targeting this flaw. Security vendors are updating their detection signatures to identify exploitation attempts. The incident highlights the ongoing risks associated with DLL hijacking vulnerabilities in popular software applications.
Jun 29, 2026
A critical vulnerability has been identified in the `systeminformation` library for Node.js, specifically affecting Windows systems. The flaw, tracked as CVE-2025-68154, resides in the `fsSize()` function, which fails to properly sanitize the `drive` parameter before concatenating it into a PowerShell command. This oversight allows for OS command injection, enabling attackers to execute arbitrary commands on affected systems if user-controlled input is passed to the vulnerable function. The issue is particularly concerning given the library's widespread use, with over 16 million monthly users potentially at risk. The vulnerability is remotely exploitable and has been addressed in version 5.27.14 of the library. Security researchers emphasize that the actual risk depends on how applications utilize the `fsSize()` function; if user input is not passed to this function, the risk is mitigated. Organizations using the `systeminformation` library on Windows are strongly advised to update to the patched version immediately to prevent exploitation and potential compromise of their systems.
Jun 29, 2026