CVE Feed

    Dashboard / CVE / CVE-2026-49401

    CVE-2026-49401

    Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.14, Deno's permission system enforces filesystem and execution restrictions by comparing the requested path against the path supplied to --deny-read, --deny-write, --deny-run, or --deny-ffi. On macOS, that comparison was done at the raw-byte level while the APFS filesystem treats different Unicode spellings of the same name as the same file. That means a program could reach a denied path by spelling it differently than the deny rule. This vulnerability is fixed in 2.7.14.

    Published:Jun 23, 2026
    Last Modified:Jun 24, 2026
    EPS:Jun 23, 2026
    EPSS Score:0.00137
    CVSS Score:7.3

    Affected Products

    Vendor
    Deno
    Product
    Deno

    Exploits

    https://github.com/denoland/deno/security/advisories/GHSA-8xpq-cjcf-3wh9

    Related CVEs

    CVE-2026-55517 (CVSS 4.3) — Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.5, a Deno program that opens a client …
    CVE-2026-44726 (CVSS 7.4) — Deno is a JavaScript, TypeScript, and WebAssembly runtime. From 2.0.0 until 2.7.8, a flaw in Deno's Node.js tl…
    CVE-2026-49402 (CVSS 8.1) — Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.10, Deno's node:child_process implemen…
    CVE-2026-49406 (CVSS 5.5) — Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.12, when Deno was run in BYONM mode (n…
    CVE-2026-49411 (CVSS 6.5) — Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.0, the Node.js compatibility TCP path …
    CVE-2026-49983 (CVSS 5.2) — Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, environment access is gated by the …
    CVE-2026-49860 (CVSS 5.2) — Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, when a WebSocket connection was ope…
    CVE-2026-49859 (CVSS 5.2) — Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, when fetch() was called, Deno check…
    CVE-2026-49440 (CVSS 7.4) — Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, node:crypto.checkPrime(candidate[, …
    CVE-2026-32260 (CVSS 8.1) — Deno is a JavaScript, TypeScript, and WebAssembly runtime. From 2.7.0 to 2.7.1, A command injection vulnerabi…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High