{"id":"CVE-2026-22864","aliases":["GHSA-m3c4-prhw-mrx6"],"url":"https://o3.security/vulnerability/CVE-2026-22864","summary":"Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass","details":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. Before 2.5.6, a prior patch aimed to block spawning Windows batch/shell files by returning an error when a spawned path’s extension matched .bat or .cmd. That check performs a case-sensitive comparison against lowercase literals and therefore can be bypassed when the extension uses alternate casing (for example .BAT, .Bat, etc.). This vulnerability is fixed in 2.5.6.","published":"2026-01-15T22:58:52.463Z","modified":"2026-08-12T03:51:32.802880306Z","cvss":{"score":8.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"deno","fixedVersion":"2.5.6"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/denoland/deno/releases/tag/v2.5.6"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22864.json"},{"type":"ADVISORY","url":"https://github.com/denoland/deno/security/advisories/GHSA-m3c4-prhw-mrx6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22864"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:32.802880306Z"}}