{"id":"EUVD-2026-38547","enisaUuid":"6727ce7c-72b5-357f-84d9-774bb32a372f","description":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.14, Deno\u0027s permission system enforces filesystem and execution restrictions by comparing the requested path against the path supplied to --deny-read, --deny-write, --deny-run, or --deny-ffi. On macOS, that comparison was done at the raw-byte level while the APFS filesystem treats different Unicode spellings of the same name as the same file. That means a program could reach a denied path by spelling it differently than the deny rule. This vulnerability is fixed in 2.7.14.","datePublished":"Jun 23, 2026, 5:22:32 PM","dateUpdated":"Jul 31, 2026, 1:15:42 PM","baseScore":7.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","references":"https://github.com/denoland/deno/security/advisories/GHSA-8xpq-cjcf-3wh9\n","aliases":"CVE-2026-49401\nGHSA-8xpq-cjcf-3wh9\n","assigner":"GitHub_M","epss":0.2,"enisaIdProduct":[{"id":"b406320d-99ef-31ab-860c-60d104601f8e","product":{"name":"deno","vendor":{"name":"denoland"}},"product_version":"\u003c 2.7.14"}],"enisaIdVendor":[{"id":"191a0181-23cb-3f71-becb-dffd4436c1d1","vendor":{"name":"denoland"}}],"enisaIdVulnerability":[{"id":"00039813-7744-3449-84de-a10ddfcc2f77","vulnerability":{"id":"CVE-2026-49401","description":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.14, Deno\u0027s permission system enforces filesystem and execution restrictions by comparing the requested path against the path supplied to --deny-read, --deny-write, --deny-run, or --deny-ffi. On macOS, that comparison was done at the raw-byte level while the APFS filesystem treats different Unicode spellings of the same name as the same file. That means a program could reach a denied path by spelling it differently than the deny rule. This vulnerability is fixed in 2.7.14.","datePublished":"Jun 23, 2026, 5:22:32 PM","dateUpdated":"Jul 31, 2026, 1:15:42 PM","status":"PUBLISHED","baseScore":7.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","references":"https://github.com/denoland/deno/security/advisories/GHSA-8xpq-cjcf-3wh9\n","enisa_id":"EUVD-2026-38547\n","assigner":"GitHub_M","epss":0.2,"dataProcessed":"Nov 5, 2026, 7:19:06 AM","vulnerabilityProduct":[{"id":"83f2c1aa-1493-3dc0-91f1-1386ae43945f","product":{"name":"deno","vendor":{"name":"denoland"}},"product_version":"\u003c 2.7.14"}],"vulnerabilityVendor":[{"id":"75a6d20b-c3b5-3c0b-96fe-6f069ef7b13d","vendor":{"name":"denoland"}}]}},{"id":"abdc759b-c8da-3426-95b8-0bd3fc95fb06","vulnerability":{"id":"GHSA-8xpq-cjcf-3wh9","description":"Deno: Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)","datePublished":"Jun 16, 2026, 7:11:52 PM","dateUpdated":"Jul 31, 2026, 1:15:54 PM","baseScore":0.0,"references":"https://github.com/denoland/deno/security/advisories/GHSA-8xpq-cjcf-3wh9\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-49401\nhttps://github.com/denoland/deno\n","enisa_id":"EUVD-2026-38547\n","aliases":"GHSA-8xpq-cjcf-3wh9\nCVE-2026-49401\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}