CVE-2026-22864
📋 TL;DR
This vulnerability allows attackers to bypass Deno's security restrictions on Windows by using case variations in file extensions (.BAT, .Bat instead of .bat). Attackers could execute arbitrary batch files they shouldn't have access to. This affects all Deno users on Windows systems running versions before 2.5.6.
💻 Affected Systems
- Deno
📦 What is this software?
Deno by Deno
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise if an attacker can upload or control batch files with alternate casing.
Likely Case
Local privilege escalation or execution of unauthorized batch scripts within Deno's security context.
If Mitigated
No impact if proper file permissions and input validation prevent unauthorized file execution.
🎯 Exploit Status
Exploitation requires ability to control or influence file paths being spawned by Deno applications.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.5.6
Vendor Advisory: https://github.com/denoland/deno/security/advisories/GHSA-m3c4-prhw-mrx6
Restart Required: Yes
Instructions:
1. Update Deno using: deno upgrade --version 2.5.6
2. Restart all Deno processes and applications
3. Verify update with: deno --version
🔧 Temporary Workarounds
Input validation for file extensions
windowsImplement case-insensitive validation for file extensions before spawning processes
// In Deno code: validate extension with .toLowerCase() before spawn
Restrict file permissions
windowsEnsure batch files in Deno-accessible directories have restricted permissions
icacls *.bat /deny Everyone:(R,X)
icacls *.cmd /deny Everyone:(R,X)
🧯 If You Can't Patch
- Implement strict input validation for all file paths used in spawn operations
- Use application allowlisting to restrict which files Deno can execute
🔍 How to Verify
Check if Vulnerable:
Check Deno version: deno --version. If version is less than 2.5.6, system is vulnerable.Check Version:
deno --versionVerify Fix Applied:
Run: deno --version. Confirm output shows 2.5.6 or higher.📡 Detection & Monitoring
Log Indicators:
- Deno spawn operations with .BAT, .Bat, .CMD, .Cmd extensions
- Unexpected batch file execution from Deno processes
Network Indicators:
- Unusual outbound connections from Deno processes post-batch execution
SIEM Query:
process_name:deno.exe AND (cmdline:*\.BAT OR cmdline:*\.Bat OR cmdline:*\.CMD OR cmdline:*\.Cmd)