If your Deno app on Windows passes untrusted input to spawn , spawnSync , or exec with shell: true — patch now. CVE-2026-103473 (CVSS 8. 1) is a command injection vulnerability in Deno's node:child_process polyfill.
Source: [Dev.to](https://dev.to/threataft_dev/deno-cve-2026-103473-cvss-81-command-injection-in-nodechildprocess-on-windows-dah)