PT-2026-50145 · Deno · Deno

Tomasilluminati · CVE-2026-49401 · Published 2026-06-16 · Updated 2026-06-23

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Deno versions prior to 2.7.14

Description Deno's permission system on macOS enforces filesystem and execution restrictions by comparing requested paths against those supplied to --deny-read, --deny-write, --deny-run, or --deny-ffi. The comparison was performed at the raw-byte level, whereas the APFS filesystem treats different Unicode spellings and case variations of the same name as the same file. This allows a program to bypass restrictions and access a denied path by using an equivalent Unicode spelling (such as NFD instead of NFC, ligatures, or different casing). Consequently, the permission check passes at the byte level, but the kernel resolves the paths to the same inode and grants access.

Recommendations Update to version 2.7.14. Prefer using --allow-* allowlists over --deny-* denylists. Avoid relying on path case-sensitivity for security boundaries on macOS.

Exploit

Fix

Weakness Enumeration

CWE-41

CWE-176

Related Identifiers

CVE-2026-49401

GHSA-8XPQ-CJCF-3WH9

Affected Products

Deno

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49401.json · Exploit
• https://github.com/denoland/deno/security/advisories/GHSA-8xpq-cjcf-3wh9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-49401 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8xpq-cjcf-3wh9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-49401 · Security Note
• https://github.com/denoland/deno · Note
• https://t.me/CVEtracker/57703 · Telegram Post