By vendor

Deno vulnerabilities

Known CVEs affecting Deno products, prioritized by severity, with SEC.co remediation and detection guidance.

3 published vulnerabilities

• CVE-2026-49402HIGH 8.1

  Deno's implementation of Node.js child process spawning on Windows contains a command injection vulnerability in its shell argument escaping logic. When developers use the shell:true option with spawn, spawnSync, exec, or related functions, Deno fails to properly quote and escape arguments containing Windows cmd.exe metacharacters, particularly the percent sign (%). An attacker who can control any part of an argument passed to these functions can inject and execute arbitrary additional commands within the spawned cmd.exe process. This affects Deno versions before 2.7.10 and is resolved in that release.

• CVE-2026-44726HIGH 7.4

  Deno versions 2.0.0 through 2.7.7 contain a flaw in how they handle TLS connections when automatic address-family fallback is enabled. If an initial connection attempt fails (such as dropping IPv6 traffic), Deno may reuse stale TLS upgrade logic when establishing a replacement connection, resulting in the new TCP connection never being encrypted. An attacker who can reliably trigger the first connection attempt to fail—for example, by blocking IPv6 on a dual-stack network—could force application data to be transmitted in plaintext, allowing them to intercept or modify traffic the application believed was secure.

• CVE-2026-49401HIGH 7.3

  Deno's permission system on macOS can be bypassed using Unicode character variations that represent the same filename. When you tell Deno to block access to a file using `--deny-read`, `--deny-write`, `--deny-run`, or `--deny-ffi`, the runtime compares the requested path against your deny rule at the byte level. However, APFS (Apple's filesystem) treats different Unicode representations of the same character as identical files. An attacker can exploit this mismatch by requesting a file using an alternate Unicode spelling, circumventing the intended permission restriction. This is fixed in Deno 2.7.14.