{"id":"CVE-2026-49401","revision":"5ce5d8d7e0dd4f4ca94eb3caf239ce1b","records":[{"revision":"5ce5d8d7e0dd4f4ca94eb3caf239ce1b","observedAt":"2026-10-27T13:11:58.28+00:00","statement":{"source":"nvd","id":"CVE-2026-49401","aliases":[],"title":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.14, Deno's permission system enforces filesystem and execution restrictions by comparing the requested path against the path supplied to --deny-read, --deny-write, --de…","description":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.14, Deno's permission system enforces filesystem and execution restrictions by comparing the requested path against the path supplied to --deny-read, --deny-write, --deny-run, or --deny-ffi. On macOS, that comparison was done at the raw-byte level while the APFS filesystem treats different Unicode spellings of the same name as the same file. That means a program could reach a denied path by spelling it differently than the deny rule. This vulnerability is fixed in 2.7.14.","state":0,"publishedAt":"2026-06-23T18:18:03.033+00:00","modifiedAt":"2026-10-25T23:10:00.167+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","score":7.3,"severity":"HIGH"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","score":8.4,"severity":"HIGH"}],"references":["https://github.com/denoland/deno/security/advisories/GHSA-8xpq-cjcf-3wh9"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-49401","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-41","CWE-176"],"productCriteria":["cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:*","cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*"],"sourceDates":{"published":"2026-06-23T18:18:03.033","lastModified":"2026-10-25T23:10:00.167"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-49401","identifiers":["CVE-2026-49401"]},"retained":false,"historicalAffected":[]}],"coverage":[]}