Vulnerability Description
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.14, Deno's permission system enforces filesystem and execution restrictions by comparing the requested path against the path supplied to --deny-read, --deny-write, --deny-run, or --deny-ffi. On macOS, that comparison was done at the raw-byte level while the APFS filesystem treats different Unicode spellings of the same name as the same file. That means a program could reach a denied path by spelling it differently than the deny rule. This vulnerability is fixed in 2.7.14.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Deno | Deno | < 2.7.14 |
| Apple | Macos | - |
Related Weaknesses (CWE)
References
- https://github.com/denoland/deno/security/advisories/GHSA-8xpq-cjcf-3wh9ExploitMitigationVendor Advisory
FAQ
What is CVE-2026-49401?
CVE-2026-49401 is a vulnerability with a CVSS score of 7.3 (HIGH). Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.14, Deno's permission system enforces filesystem and execution restrictions by comparing the requested path against the path sup...
How severe is CVE-2026-49401?
CVE-2026-49401 has been rated HIGH with a CVSS base score of 7.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-49401?
Check the references section above for vendor advisories and patch information. Affected products include: Deno Deno, Apple Macos.