PT-2026-3146 · Deno · Deno

Sharokhataie · CVE-2026-22864 · Published 2026-01-15 · Updated 2026-04-14

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Deno versions prior to 2.5.6

Description Deno is a JavaScript, TypeScript, and WebAssembly runtime. A previous attempt to prevent the execution of Windows batch and shell files by checking file extensions (.bat or .cmd) was ineffective due to a case-sensitive comparison. This allowed bypassing the restriction by using alternate casing for the file extension (e.g., .BAT, .Bat). The issue is addressed in version 2.5.6.

Recommendations Update to Deno version 2.5.6 or later.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2026-22864

GHSA-M3C4-PRHW-MRX6

JLSEC-2026-115

Affected Products

Deno

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22864.json · Exploit
• https://github.com/denoland/deno/security/advisories/GHSA-m3c4-prhw-mrx6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-22864 · Vendor Advisory
• https://osv.dev/vulnerability/JLSEC-2026-115 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22864 · Security Note
• https://osv.dev/vulnerability/GHSA-m3c4-prhw-mrx6 · Vendor Advisory
• https://github.com/denoland/deno · Note
• https://github.com/denoland/deno/releases/tag/v2.5.6 · Note
• https://twitter.com/CVEnew/status/2012126517099119036 · Twitter Post
• https://twitter.com/TheHackerWire/status/2011951922228707762 · Twitter Post
• https://twitter.com/CrowdCyber_Com/status/2013305107622797790 · Twitter Post
• https://twitter.com/Komodosec/status/2026435621481492988 · Twitter Post
• https://twitter.com/Karma_X_Inc/status/2013054963954372680 · Twitter Post
• https://t.me/cveNotify/149389 · Telegram Post
• https://github.com/advisories/GHSA-m3c4-prhw-mrx6 · Note