CVE Intelligence
Analysis AI-assisted

CVE-2026-22864: Deno: incomplete Windows command-injection prevention, case-sensitive .bat/.cmd extension bypass

Deno before 2.5.6 included a check meant to block spawning Windows batch and shell files with .bat or .cmd extensions. The check is case-sensitive, so alternate letter casing can bypass it, and the record states the issue is fixed in 2.5.6.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

Deno is a JavaScript, TypeScript and WebAssembly runtime. A previous patch tried to stop spawning Windows batch or shell files by rejecting paths ending in .bat or .cmd, but the comparison is case-sensitive, so alternate letter casing can slip past it. The record states the issue is fixed in 2.5.6.

Impact

  • The record classifies the weakness as CWE-77 (Command Injection).
  • NVD assigns a CVSS base score of 9.8 (critical) with high confidentiality, integrity and availability impact. GitHub's entry scores it 8.1.
  • The SSVC fields in the record indicate exploitation status 'none', not automatable, and total technical impact.

Affected products and versions

  • The record lists Deno versions before 2.5.6 as affected, under two product labels (Deno Deno and Denoland Deno).
  • The fixed version is 2.5.6.

Exploitation status

The record shows this vulnerability is not listed in CISA KEV. No confirmed exploitation appears in the sources consulted. One referenced item is tagged as an exploit reference; its content was not analyzed here.

Remediation and mitigation

  • Upgrade Deno to 2.5.6 or a later release.
  • Until upgrading, avoid running untrusted scripts that launch batch or shell files on Windows, and restrict which processes may create such child processes.
  • Do not rely on extension-based filtering alone as a control for this class of issue.

Detection guidance

  • Review application logs and process creation records on Windows hosts running Deno for child processes launched as batch or shell files, paying attention to unusual extension casing.
  • Inventory Deno installations and compare their versions with the fixed release.

Limitations of the available information

The structured fixes field is empty, so the fixed version is taken from the description and the release reference. Details of the exploit-tagged reference, the exact code path and any observed exploitation attempts are not available in this record.

Frequently asked questions

What is the core flaw in CVE-2026-22864?

A check meant to block Windows batch and shell files with .bat or .cmd extensions compares extensions case-sensitively, so alternate casing such as .BAT can bypass it.

Which version fixes it?

The record states the issue is fixed in 2.5.6, and affected versions are those before 2.5.6.

Is this vulnerability known to be actively exploited?

The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.