Deno's permission system enforces filesystem and execution restrictions by comparing requested paths against deny rules. On macOS, the comparison was performed at the raw-byte level, while the APFS filesystem treats different Unicode representations of the same filename as equivalent. This discrepancy allowed a program to bypass deny rules by using alternate Unicode spellings of a denied path. The vulnerability affects Deno versions prior to 2.7.14 and is resolved in 2.7.14.

An attacker with limited privileges could bypass Deno's permission restrictions on filesystem and execution operations by exploiting Unicode path equivalence on macOS. This could lead to unauthorized read, write, execution, or foreign function interface (FFI) access, potentially compromising confidentiality and integrity of the system or data. The CVSS score is 7.3 (high), reflecting local attack vector with low complexity, requiring limited privileges, no user interaction, and resulting in partial confidentiality loss and high integrity impact.

Upgrade Deno to version 2.7.14 or later, where this vulnerability is fixed. No other mitigation is indicated or required as the fix addresses the root cause.