denoland deno up to 2.7.13 APFS File resolution of path

Summaryinfo

A vulnerability was found in denoland deno up to 2.7.13. It has been declared as problematic. This vulnerability affects unknown code of the component APFS File Handler. Such manipulation leads to resolution of path. This vulnerability is referenced as CVE-2026-49401. The attack can only be performed from a local environment. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in denoland deno up to 2.7.13. Affected by this issue is some unknown processing of the component APFS File Handler. The manipulation with an unknown input leads to a resolution of path vulnerability. Using CWE to declare the problem leads to CWE-41. The product is vulnerable to file system contents disclosure through path equivalence. Path equivalence involves the use of special characters in file and directory names. The associated manipulations are intended to generate multiple names for the same object. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.14, Deno's permission system enforces filesystem and execution restrictions by comparing the requested path against the path supplied to --deny-read, --deny-write, --deny-run, or --deny-ffi. On macOS, that comparison was done at the raw-byte level while the APFS filesystem treats different Unicode spellings of the same name as the same file. That means a program could reach a denied path by spelling it differently than the deny rule. This vulnerability is fixed in 2.7.14.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-49401 since 05/29/2026. The exploitation is known to be easy. The attack needs to be approached locally. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1006.

Upgrading to version 2.7.14 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• denoland

Name

• deno

Version

• 2.7.0
• 2.7.1
• 2.7.2
• 2.7.3
• 2.7.4
• 2.7.5
• 2.7.6
• 2.7.7
• 2.7.8
• 2.7.9
• 2.7.10
• 2.7.11
• 2.7.12
• 2.7.13

Website

• Product: https://github.com/denoland/deno/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion