Loading story…
Deno disclosed a high-severity command injection vulnerability in its Windows implementation of node:child_process, where the escapeShellArg() helper failed to safely handle cmd.exe metacharacters such as &, |, <, >, ^, !, (, ), and %. When applications used shell: true with spawn, spawnSync, exec, and related APIs, attacker-controlled input could break out of the intended argument context and execute arbitrary commands in the security context of the Deno process. A proof of concept showed calc.exe launching on Windows 11 after a crafted argument was passed to spawnSync.
The issue is tracked as CVE-2026-49402 and affects Deno versions prior to 2.7.10 on Windows. The flaw is considered the Windows counterpart to CVE-2026-27190, which addressed the same bug class on Unix-like systems. Deno said deployments are not affected when shell: true is not used, and advised users to upgrade to 2.7.10 and avoid passing untrusted input into shelled subprocess calls.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
The vulnerability was fixed in Deno version 2.7.10, addressing command injection on Windows in versions prior to 2.7.10. Users were advised to upgrade and avoid using shell: true with user-controlled input.
Deno disclosed a command injection flaw in its Windows node:child_process implementation when shell: true was used with spawn, spawnSync, exec, and related APIs. The advisory described improper handling of cmd.exe metacharacters in escapeShellArg() and included a proof of concept showing calc.exe being launched via a crafted argument.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity vulnerability, tracked as CVE-2025-61787, was identified in Deno, a runtime for JavaScript, TypeScript, and WebAssembly. The flaw specifically affects Windows systems and allows for command injection when batch files are executed. The vulnerability arises because, on Windows, the CreateProcess() function implicitly invokes cmd.exe when executing batch files, even if the application does not explicitly specify it. This behavior enables attackers to inject arbitrary commands if they can influence the batch file execution process. Deno versions prior to 2.5.3 and 2.2.15 are confirmed to be vulnerable to this issue. The vulnerability is remotely exploitable, increasing the risk for systems running affected Deno versions on Windows. Security advisories highlight that the issue is fixed in Deno versions 2.5.3 and 2.2.15, and users are urged to upgrade to these or later versions to mitigate the risk. The vulnerability was disclosed publicly in early October 2025, and its high CVSS score of 8.1 reflects the significant risk it poses. The flaw could potentially allow attackers to execute arbitrary commands with the privileges of the Deno process, leading to system compromise or further lateral movement. The vulnerability does not appear to affect non-Windows platforms, as the underlying issue is tied to Windows-specific process creation behavior. No reports of active exploitation have been confirmed at the time of disclosure, but the remote exploitability and ease of triggering the flaw make it a priority for patching. The Deno development team responded promptly by releasing patched versions and providing detailed advisories to the community. Organizations using Deno in production on Windows are strongly advised to audit their deployments and ensure all instances are updated. Security teams should also review application logic to ensure that untrusted input cannot influence batch file execution. The vulnerability underscores the importance of understanding platform-specific behaviors in cross-platform runtimes. Deno's maintainers have also recommended additional security best practices for users who cannot immediately upgrade. The disclosure has prompted broader discussions about secure process execution and command injection risks in modern runtimes.
Jun 29, 2026
SafeBreach Labs disclosed **CVE-2025-59199**, a Windows 11 sandbox escape that allows a low-integrity process to gain medium-integrity code execution and perform arbitrary file writes after a single user click. The attack, dubbed **"Click Or Trick,"** chains weaknesses across several Windows components rather than exploiting one isolated flaw, combining a misconfigured COM object, Windows app identity and toast notification behavior, Snipping Tool URI handling, URI decoding quirks, and Microsoft Teams' exposed Chromium remote debugging interface. Researchers showed an attacker could launch a medium-integrity COM server from a low-integrity context, spoof a trusted toast notification, append attacker-controlled command-line arguments to legitimate applications, and then abuse the Chrome DevTools Protocol to write files outside the sandbox. Microsoft assigned the issue a **CVSS 7.8** score after it was reported on July 13, 2025, and released a patch on October 14, 2025; the findings underscore how security gaps at the boundaries between unrelated Windows subsystems can be combined into a practical sandbox escape chain.
Jun 29, 2026
Researchers disclosed a **critical remote code execution issue** in the Windows `ms-officecmd:` URI handler that let attackers inject arguments into Microsoft application launches through crafted JSON passed to `LocalBridge.exe` and `AppBridge.dll`. The flaw affected Windows 10 and 11 and could be used to start applications including **Teams, Skype, and Outlook** with attacker-controlled parameters, enabling arbitrary command execution, interception of Teams traffic, exposure of the Node.js debugger, and Outlook-assisted phishing scenarios. The researchers reported that **Internet Explorer 11** and **Edge Legacy** on Windows 10 could invoke the malicious URI without showing an external-protocol confirmation prompt, creating a drive-by exploitation path when Teams was installed and not already running. Microsoft initially dismissed the report, later reclassified it as **Critical RCE**, awarded a **$5,000 bounty**, and released a partial fix, but the researchers said the underlying argument-injection weakness remained present on fully patched Windows 10 and Windows 11 systems at the time of publication.
Jul 24, 2026