Arbitrary command execution via unescaped shell arguments

Command injection in Deno before 2.6.8 allows remote attackers to execute arbitrary OS commands through node:child_process. When spawn or spawnSync uses shell:true with an argument array, normalizeSpawnArguments joins the executable and arguments into a shell command without escaping them, so a newline in an attacker-controlled argument starts another command. Exploitation requires a Deno application to pass attacker-controlled arguments to either API with shell execution enabled, and injected commands run with the application's OS privileges.