CVE-2026-49401: Deno macOS Permission Bypass via Unicode Path Equivalence

Technical summary

CVE-2026-49401 exploits a fundamental mismatch between Deno's permission enforcement mechanism and macOS APFS filesystem semantics. Deno's --deny-* flags perform octet-by-octet path comparison without normalizing Unicode representations. APFS employs Unicode Normalization Form D (decomposed form), meaning characters like 'é' (single precomposed character) and 'é' (e + combining accent) resolve to the same inode. A denial rule targeting `/path/to/dëned_file` (decomposed) fails to block access to `/path/to/denied_file` (precomposed), allowing reads, writes, FFI calls, or execution against supposedly restricted resources. The vulnerability stems from CWE-176 (Improper Handling of Unicode Encoding) and CWE-41 (Improper Resolution of Path Equivalence).

Business impact

For organizations using Deno in security-sensitive contexts—particularly sandboxed environments, multi-tenant deployments, or plugin systems—this vulnerability undermines the trust model of capability-based restrictions. A malicious or compromised Deno script running with reduced privileges can sidestep filesystem and code execution controls, potentially exfiltrating sensitive data, modifying protected resources, or loading unauthorized native libraries via FFI. The impact is particularly acute in macOS-based development and containerized workflows where Deno permissions serve as a primary isolation boundary.

Affected systems

All versions of Deno prior to 2.7.14 running on macOS are vulnerable. The vulnerability does not affect Deno on Linux, Windows, or other operating systems, as those filesystems do not exhibit APFS's Unicode normalization behavior. macOS users of Deno versions 2.7.13 and earlier should prioritize patching. Deno on Apple silicon (M1/M2/M3) and Intel-based Macs are equally affected.

Exploitability

Exploitation requires local access to a system running vulnerable Deno and the ability to execute a Deno script. The attacker must know or guess a deny rule's target path and then craft an alternate Unicode representation to bypass it. No network component, special privileges beyond script execution, or user interaction is necessary. The bar for exploitation is low; generating Unicode variants is straightforward using standard tools. However, real-world impact depends on what resources the deny rule protects and whether an attacker has script execution capability in that context.

Remediation

Upgrade Deno to version 2.7.14 or later immediately on all macOS systems. No workarounds exist for earlier versions. Review deny-read, deny-write, deny-run, and deny-ffi rules in your Deno scripts and runtime configurations to ensure they align with your security posture post-patch. Consider auditing logs for suspicious script activity on macOS deployments running Deno versions 2.7.13 and earlier.

Patch guidance

Download and install Deno 2.7.14 from the official Deno website or package manager (Homebrew, etc.). Verify the installed version with `deno --version`. No breaking changes are documented; the patch is a security fix. For CI/CD pipelines, update Deno in container images and lock files to 2.7.14 or later. Recommend pushing this update to all development and production machines running Deno on macOS within 7–14 days depending on your environment's criticality.

Detection guidance

Monitor Deno process execution on macOS for unusual Unicode path arguments or repeated attempts to access denied resources. Check Deno logs (if enabled) for permission denials followed by successful access to similarly-named files with different Unicode encoding. Behavioral indicators include scripts attempting to read from `/Users/*/sensitive_data` variants or executing binaries with decomposed vs. precomposed character names. Static analysis of Deno configuration files should flag deny rules and cross-check them against known Unicode normalization issues.

Why prioritize this

This vulnerability rates HIGH (CVSS 7.3) due to the combination of low attack complexity, local attack vector, and the capacity to bypass security controls that organizations may rely on for privilege separation and data protection. While exploitation requires local code execution, the ability to circumvent explicit deny rules is a direct violation of the security model users expect. On macOS-heavy teams and environments where Deno serves sandbox or plugin roles, this should be treated as a priority patch.

Risk score, explained

CVSS 3.1 score of 7.3 reflects: (1) Local Attack Vector (AV:L)—attacker must execute code locally; (2) Low Attack Complexity (AC:L)—no special conditions needed, Unicode variants are trivial to generate; (3) Low Privileges (PR:L)—any user running Deno can trigger the bypass; (4) No User Interaction (UI:N); (5) Changed Scope (S:C)—the bypass affects the entire system's ability to trust Deno's permission model; (6) Low Confidentiality Impact (C:L) and High Integrity Impact (I:H)—an attacker can read and especially modify protected resources; (7) No Availability Impact (A:N). The HIGH severity is justified by the direct undermining of a security boundary.

Frequently asked questions