{"action":"Upgrade deno to 2.6.8 or later.","affected":[{"fixed":"2.6.8","introduced":"2.6.7"}],"component":"deno","cve_ids":["CVE-2026-27190"],"ecosystem":"deno","epss":0.0246,"exploited":false,"fixed_versions":["2.6.8"],"ghsa_id":"GHSA-hmh4-3xvx-q5hr","id":"tcs_01M5K4YRAJE0JV8GFMXAV5PVQQ","modified_at":"2026-02-19T08:16:18Z","published_at":"2026-02-19T08:16:18Z","references":["https://github.com/denoland/deno/security/advisories/GHSA-hmh4-3xvx-q5hr","https://www.cve.org/CVERecord?id=CVE-2026-27190"],"severity":{"label":"high","score":8.1},"sources":[{"source":"deno-runtime","source_id":"GHSA-hmh4-3xvx-q5hr","url":"https://github.com/denoland/deno/security/advisories/GHSA-hmh4-3xvx-q5hr"}],"summary":"Command Injection via Incomplete shell metacharacter blocklist in `node:child_process`"}