{"action":"Upgrade deno to 2.7.2 or later.","affected":[{"fixed":"2.7.2","introduced":"2.7.0"}],"component":"deno","cve_ids":["CVE-2026-32260"],"ecosystem":"deno","exploited":false,"fixed_versions":["2.7.2"],"ghsa_id":"GHSA-4c96-w8v2-p28j","id":"tcs_01M5K4YRSKS8FBHZH4K18CX15M","modified_at":"2026-03-12T15:49:32Z","published_at":"2026-03-12T15:49:32Z","references":["https://github.com/denoland/deno/security/advisories/GHSA-4c96-w8v2-p28j","https://www.cve.org/CVERecord?id=CVE-2026-32260"],"severity":{"label":"high","score":8.1},"sources":[{"source":"deno-runtime","source_id":"GHSA-4c96-w8v2-p28j","url":"https://github.com/denoland/deno/security/advisories/GHSA-4c96-w8v2-p28j"}],"summary":"Command Injection via incomplete shell metacharacter blocklist in node:child_process (bypass of CVE-2026-27190 fix)"}