CVE-2026-49401: deno Improper Resolution of Path Equivalence

Vulnerability summary

CVE-2026-49401 is a high (CVSS 8.4) Improper Resolution of Path Equivalence vulnerability in deno. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 8.8% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 23-06-2026
   PublishedVulnerability first disclosed.
2. 31-07-2026
   Last modifiedVulnerability information updated.

Description

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.14, Deno's permission system enforces filesystem and execution restrictions by comparing the requested path against the path supplied to --deny-read, --deny-write, --deny-run, or --deny-ffi. On macOS, that comparison was done at the raw-byte level while the APFS filesystem treats different Unicode spellings of the same name as the same file. That means a program could reach a denied path by spelling it differently than the deny rule. This vulnerability is fixed in 2.7.14.

• CWE-41Improper Resolution of Path EquivalenceThe product is vulnerable to file system contents disclosure through path equivalence. Path equivalence involves the use of special characters in file and directory names. The associated manipulations are intended to generate multiple names for the same object.
• CWE-176Improper Handling of Unicode EncodingThe product does not properly handle when an input contains Unicode encoding.