CVE-2026-49401: Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.14, Deno's permission system enforces filesystem and execution restrictions by…

PriorityP342high8.4CVSS 3.1

AVLACLPRLUINSCCHIHAN

EPSS

0.20%

9.7th percentile

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.14, Deno's permission system enforces filesystem and execution restrictions by comparing the requested path against the path supplied to --deny-read, --deny-write, --deny-run, or --deny-ffi. On macOS, that comparison was done at the raw-byte level while the APFS filesystem treats different Unicode spellings of the same name as the same file. That means a program could reach a denied path by spelling it differently than the deny rule. This vulnerability is fixed in 2.7.14.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
deno	deno	< 2.7.14	2.7.14
deno	deno	>= 0 < 2.7.14	2.7.14
denoland	deno	< 2.7.14	2.7.14

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.