{"id":"CVE-2026-22864","aliases":["GHSA-m3c4-prhw-mrx6"],"url":"https://o3.security/vulnerability/CVE-2026-22864","summary":"Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass","details":"### Summary\nA prior patch aimed to block spawning Windows batch/shell files by returning an error when a spawned path’s extension matched `.bat` or `.cmd`. That check performs a case-sensitive comparison against lowercase literals and therefore can be bypassed when the extension uses alternate casing (for example `.BAT, .Bat`, etc.).\n\n### POC\n```javascript\nconst command = new Deno.Command('./test.BAT', {\n  args: ['&calc.exe'],\n});\nconst child = command.spawn();\n```\nThis causes `calc.exe` to be launched; see the attached screenshot for evidence.\n\n**Patched in `CVE-2025-61787` — prevents execution of `.bat` and `.cmd` files:**\n![photo_2025-10-10 02 27 23](https://github.com/user-attachments/assets/43df25e2-e2e1-48aa-8060-cb0a22637f1f)\n\n**Bypass of the patched vulnerability:**\n![photo_2025-10-10 02 27 25](https://github.com/user-attachments/assets/2be1afb4-84a1-4883-8e18-6a174fdd3615)\n\n\n### Impact\nThe script launches calc.exe on Windows, demonstrating that passing user-controlled arguments to a spawned batch script can result in command-line injection.\n\n### Mitigation\n\nUsers should update to Deno v2.5.6 or newer.","published":"2026-01-15T22:58:52.463Z","modified":"2026-10-28T02:30:30.402118851Z","cvss":{"score":8.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"deno","fixedVersion":"2.5.6"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/denoland/deno/releases/tag/v2.5.6"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22864.json"},{"type":"ADVISORY","url":"https://github.com/denoland/deno/security/advisories/GHSA-m3c4-prhw-mrx6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22864"},{"type":"PACKAGE","url":"https://github.com/denoland/deno"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:30.402118851Z"}}