Vulnerability · Published Jan 15, 2026 · Assigned by GitHub_M

CVE-2026-22864Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass

High 8.1

In plain English

A high-severity command injection in deno from denoland. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.7%top 47.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Before 2.5.6, a prior patch aimed to block spawning Windows batch/shell files by returning an error when a spawned path’s extension matched .bat or .cmd. That check performs a case-sensitive comparison against lowercase literals and therefore can be bypassed when the extension uses alternate casing (for example .BAT, .Bat, etc.). This vulnerability is fixed in 2.5.6.

Affected products (as reported)

Vendor	Product	Versions
denoland	deno	< 2.5.6

Weakness: CWE-77 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/denoland/deno/security/advisories/GHSA-m3c4-prhw-mrx6 x_refsource_CONFIRM
https://github.com/denoland/deno/releases/tag/v2.5.6 x_refsource_MISC