CVE-2026-49401: CWE-41: Improper Resolution of Path Equivalence in denoland deno
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.14, Deno's permission system enforces filesystem and execution restrictions by comparing the requested path against the path supplied to --deny-read, --deny-write, --deny-run, or --deny-ffi. On macOS, that comparison was done at the raw-byte level while the APFS filesystem treats different Unicode spellings of the same name as the same file. That means a program could reach a denied path by spelling it differently than the deny rule. This vulnerability is fixed in 2.7.14.
AI Analysis
Technical Summary
Deno's permission system enforces restrictions on filesystem and execution access by comparing requested paths against deny rules (--deny-read, --deny-write, --deny-run, --deny-ffi). On macOS, the comparison was done at the raw-byte level, ignoring APFS's Unicode equivalence of filenames. This improper resolution of path equivalence (CWE-41) allows a program to bypass deny rules by using different Unicode spellings of the same path. The vulnerability affects versions prior to 2.7.14 and is resolved in 2.7.14.
Potential Impact
An attacker with limited privileges can bypass Deno's permission restrictions on macOS by exploiting Unicode path equivalence, potentially gaining unauthorized read, write, execution, or FFI access to files or commands that should be denied. The CVSS score of 7.3 reflects high severity with low attack complexity and no user interaction required, but local privileges needed.
Mitigation Recommendations
Upgrade Deno to version 2.7.14 or later, where this vulnerability is fixed. No other mitigation is indicated or required.
CVE-2026-49401: CWE-41: Improper Resolution of Path Equivalence in denoland deno
Description
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.14, Deno's permission system enforces filesystem and execution restrictions by comparing the requested path against the path supplied to --deny-read, --deny-write, --deny-run, or --deny-ffi. On macOS, that comparison was done at the raw-byte level while the APFS filesystem treats different Unicode spellings of the same name as the same file. That means a program could reach a denied path by spelling it differently than the deny rule. This vulnerability is fixed in 2.7.14.
CVSS v3.1
Score 7.3high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Deno's permission system enforces restrictions on filesystem and execution access by comparing requested paths against deny rules (--deny-read, --deny-write, --deny-run, --deny-ffi). On macOS, the comparison was done at the raw-byte level, ignoring APFS's Unicode equivalence of filenames. This improper resolution of path equivalence (CWE-41) allows a program to bypass deny rules by using different Unicode spellings of the same path. The vulnerability affects versions prior to 2.7.14 and is resolved in 2.7.14.
Potential Impact
An attacker with limited privileges can bypass Deno's permission restrictions on macOS by exploiting Unicode path equivalence, potentially gaining unauthorized read, write, execution, or FFI access to files or commands that should be denied. The CVSS score of 7.3 reflects high severity with low attack complexity and no user interaction required, but local privileges needed.
Mitigation Recommendations
Upgrade Deno to version 2.7.14 or later, where this vulnerability is fixed. No other mitigation is indicated or required.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-29T19:08:01.256Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a3ac4efeed863c81e61822e
Added to database: 06/23/2026, 17:39:59 UTC
Last enriched: 07/31/2026, 19:51:22 UTC
Last updated: 08/05/2026, 12:50:58 UTC
Views: 52
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.