github.com
https://github.com/denoland/deno CVE-2026-22864
HIGH
Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass
Record summary
CVE-2026-22864 has a selected CVSS score of 8.1 (high).
Description
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Before 2.5.6, a prior patch aimed to block spawning Windows batch/shell files by returning an error when a spawned path’s extension matched .bat or .cmd. That check performs a case-sensitive comparison against lowercase literals and therefore can be bypassed when the extension uses alternate casing (for example .BAT, .Bat, etc.). This vulnerability is fixed in 2.5.6.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 16, 2026 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
| CVE List | < 2.5.6 | affected | |
| GitHub Advisory | Before 2.5.6 · Fixed in 2.5.6 | affected |
References
4github.com
https://github.com/denoland/deno/releases/tag/v2.5.6 github.comConfirmation
https://github.com/denoland/deno/security/advisories/GHSA-m3c4-prhw-mrx6 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-22864