CVE-2026-49401

HIGH EPSS 4.1%

Published Jun 23, 20261w ago · Modified Jun 23, 20261w ago

7.3 CVSS 3.1

High

Published Jun 23, 2026 1w ago

Last Modified Jun 23, 2026 1w ago

Description

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.14, Deno's permission system enforces filesystem and execution restrictions by comparing the requested path against the path supplied to --deny-read, --deny-write, --deny-run, or --deny-ffi. On macOS, that comparison was done at the raw-byte level while the APFS filesystem treats different Unicode spellings of the same name as the same file. That means a program could reach a denied path by spelling it differently than the deny rule. This vulnerability is fixed in 2.7.14.

CVSS Details

Base Score

7.3

Exploitability

2.0

Impact

4.7

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N

Attack Vector Local

Attack Complexity Low

Privileges Required Low

User Interaction None

Scope Changed

Confidentiality Low

Integrity High

Availability None

Threat Intelligence

EPSS Exploit Probability

4.1% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 2

CWE-176

CWE-41

References 1

github.com https://github.com/denoland/deno/security/advisories/GHSA-8xpq-cjcf-3wh9

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.