How severe is CVE-2026-49401?

CVE-2026-49401 has a CVSS 3.x base score of 7.3, rated high severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity high, and availability none.

Is CVE-2026-49401 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (4th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-49401?

CVE-2026-49401 affects Deno. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-49401?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2026-49401 have an EU (EUVD) identifier?

Yes. CVE-2026-49401 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-38547.

When was CVE-2026-49401 published?

CVE-2026-49401 was published on 2026-06-23 and last updated on 2026-06-26.

CVE-2026-49401

CVE-2026-49401 is a high-severity vulnerability in Deno with a CVSS 3.x base score of 7.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-41.

Key facts

Severity: High (CVSS 3.x base score 7.3)
EPSS exploit prediction: 0% (4th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-38547
Weakness: CWE-41
Affected product: Deno
Published: 2026-06-23
Last modified: 2026-06-26

Description

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.14, Deno's permission system enforces filesystem and execution restrictions by comparing the requested path against the path supplied to --deny-read, --deny-write, --deny-run, or --deny-ffi. On macOS, that comparison was done at the raw-byte level while the APFS filesystem treats different Unicode spellings of the same name as the same file. That means a program could reach a denied path by spelling it differently than the deny rule. This vulnerability is fixed in 2.7.14.

Frequently asked questions

What is CVE-2026-49401?: Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.14, Deno's permission system enforces filesystem and execution restrictions by comparing the requested path against the path supplied to --deny-read, --deny-write, --deny-run, or --deny-ffi. On macOS, that comparison was done at the raw-byte level while the APFS filesystem treats different Unicode spellings of the same name as the same file. That means a program could reach a denied path by spelling it differently than the deny rule. This vulnerability is fixed in 2.7.14.
How severe is CVE-2026-49401?: CVE-2026-49401 has a CVSS 3.x base score of 7.3, rated high severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity high, and availability none.
Is CVE-2026-49401 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (4th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-49401?: CVE-2026-49401 affects Deno. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-49401?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2026-49401 have an EU (EUVD) identifier?: Yes. CVE-2026-49401 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-38547.
When was CVE-2026-49401 published?: CVE-2026-49401 was published on 2026-06-23 and last updated on 2026-06-26.

References

https://github.com/denoland/deno/security/advisories/GHSA-8xpq-cjcf-3wh9

Affected products (1)

cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:*

More vulnerabilities in Deno

CVE-2022-24783 — Critical (CVSS 10.0): Deno is a runtime for JavaScript and TypeScript. The versions of Deno between release 1.18.0 and 1.20.2 (inclusive) are…
CVE-2023-28445 — Critical (CVSS 9.9): Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Resizable ArrayBuffers passed to…
CVE-2021-32619 — Critical (CVSS 9.8): Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. In Deno versions 1.5.0 to 1.10.1,…
CVE-2025-48935 — Critical (CVSS 9.1): Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 2.2.0 and prior to versions 2.2.5, it is…
CVE-2024-27936 — High (CVSS 8.8): Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. Starting in version 1.32.1 and prior to…
CVE-2023-28446 — High (CVSS 8.8): Deno is a simple, modern and secure runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Arbitrary…

All CVEs affecting Deno →

Other CWE-41 vulnerabilities

CVE-2025-24470 — High (CVSS 8.6): An Improper Resolution of Path Equivalence vulnerability [CWE-41] in FortiPortal 7.4.0 through 7.4.2, 7.2.0 through…
CVE-2026-5816 — High (CVSS 8.0): GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.10.4 and 18.11 before…
CVE-2025-43298 — High (CVSS 7.8): A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in…
CVE-2024-30073 — High (CVSS 7.8): Windows Security Zone Mapping Security Feature Bypass Vulnerability
CVE-2023-36396 — High (CVSS 7.8): Windows Compressed Folder Remote Code Execution Vulnerability
CVE-2026-23674 — High (CVSS 7.5): Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to bypass a security…

Browse all CWE-41 vulnerabilities →