CVE-2026-49401
High · 7.3CVSS
7.3
EPSS
0.2%
Published
Jun 23, 2026
CISA due date
—
The record
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.14, Deno's permission system enforces filesystem and execution restrictions by comparing the requested path against the path supplied to --deny-read, --deny-write, --deny-run, or --deny-ffi. On macOS, that comparison was done at the raw-byte level while the APFS filesystem treats different Unicode spellings of the same name as the same file. That means a program could reach a denied path by spelling it differently than the deny rule. This vulnerability is fixed in 2.7.14.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | deno | 0 | 2.7.14 |
Related vulnerabilities
- GHSA-8xpq-cjcf-3wh9 Deno: Permission Bypass via Unicode Normalization Mismatch on macOS (APFS) Same vulnerability
- CVE-2026-55517 Deno is a JavaScript, TypeScript, and WebAssembly runtime. Also affects deno
- CVE-2026-49860 Deno is a JavaScript, TypeScript, and WebAssembly runtime. Also affects deno
- CVE-2026-49983 Deno is a JavaScript, TypeScript, and WebAssembly runtime. Also affects deno
- CVE-2026-49411 Deno is a JavaScript, TypeScript, and WebAssembly runtime. Also affects deno
- CVE-2026-49402 Deno is a JavaScript, TypeScript, and WebAssembly runtime. Also affects deno
- CVE-2026-49440 Deno is a JavaScript, TypeScript, and WebAssembly runtime. Also affects deno
- CVE-2026-49406 Deno is a JavaScript, TypeScript, and WebAssembly runtime. Also affects deno