Read the docs
TI-2026-18356 Aliases CVE-2026-22864GHSA-m3c4-prhw-mrx6

Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass

Priority MEDIUM 44CWE-77Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-77.

Summary

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Before 2.5.6, a prior patch aimed to block spawning Windows batch/shell files by returning an error when a spawned path’s extension matched .bat or .cmd. That check performs a case-sensitive comparison against lowercase literals and therefore can be bypassed when the extension uses alternate casing (for example .BAT, .Bat, etc.). This vulnerability is fixed in 2.5.6.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00672 52nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed deno (denoland): 2.5.6deno (crates.io): 2.5.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
denolanddenobefore 2.5.62.5.6Patch availableCNA
—deno (crates.io)before 2.5.62.5.6Patch availableGHSA-m3c4-prhw-mrx6
  • deno Vendordenoland Affected before 2.5.6 Fixed in 2.5.6 Patch available CNA
  • deno (crates.io) Vendor— Affected before 2.5.6 Fixed in 2.5.6 Patch available GHSA-m3c4-prhw-mrx6

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:*before 2.5.6Vulnerabledenoland
  • cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:* Versions before 2.5.6 Vulnerable ·denoland

Remediation

  • Fix · CNA deno (denoland) Fixed in 2.5.6
  • Fix · GHSA-m3c4-prhw-mrx6 deno (crates.io) Fixed in 2.5.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-22864
  2. 2026-10-03 Alias added: GHSA-m3c4-prhw-mrx6

References

Exploit 1

Advisory 1

Other 2

  • TI-2026-21627 Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process CVSS 3.1CRITICAL 9.8
  • TI-2025-17782 Deno's AES GCM authentication tags are not verified CVSS 4.0HIGH 7.7
  • TI-2024-18537 *const c_void / ExternalPointer unsoundness leading to use-after-free CVSS 3.1HIGH 8.8
  • TI-2024-18536 Deno arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypass CVSS 3.1HIGH 8.8
  • TI-2023-12990 Deno is vulnerable to interactive `run` permission prompt spoofing via improper ANSI neutralization CVSS 3.1HIGH 8.8
  • TI-2023-11328 Regular expression denial of service in deno CVSS 3.1HIGH 7.5
See all 37 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences