CVE-2026-22864CWE-77

Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass

High · published January 15, 2026

CVSS v3.1
8.1
EPSS
1%
Percentile
51.5
In the wild
Unconfirmed
What it is

⚡ A sneaky case-sensitivity flaw lets attackers slip past defenses with styled extensions! 🎩✨ Think of it like a restaurant that only serves vegetarian burgers. If a customer asks for a ‘Veggie’ burger but they only check for ‘veggie’, they might accidentally serve up a meat patty! This loophole could allow an attacker to execute arbitrary commands on your system, potentially leading to data breaches or server takeovers. Imagine someone tossing a firecracker into a quiet room—unexpected chaos and damage could ensue!

Put simply

Think of it like a restaurant that only serves vegetarian burgers. If a customer asks for a ‘Veggie’ burger but they only check for ‘veggie’, they might accidentally serve up a meat patty! This vulnerability in Deno arises from a case-sensitive check meant to block the spawning of Windows batch files that fails for extensions like .BAT or .Bat, enabling attackers to exploit this oversight.

What to do

This loophole could allow an attacker to execute arbitrary commands on your system, potentially leading to data breaches or server takeovers. Imagine someone tossing a firecracker into a quiet room—unexpected chaos and damage could ensue! To secure your systems, upgrade Deno to version 2.5.6 or later immediately. Additionally, review your application’s code for any other potential case-sensitivity issues to fortify against similar exploits in the future. You've got this! With these steps, you're on your way to securing your environment! 🛡️💪

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00672 · 51.5th percentile
Weakness
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2026-01-15T22:58Z
EPSS history
Timeline
  • 15 JAN 22:58Z
    Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass
    cvelistv5