CVE-2026-22864: Deno command injection via case-insensitive extension bypass on Windows

Executive brief

Deno is a JavaScript runtime used for building server-side applications. A previous security fix attempted to block execution of Windows batch files to prevent command injection attacks. However, the fix contains a flaw: it only blocks extensions written in lowercase (`.bat` and `.cmd`), but fails to block uppercase or mixed-case variants (`.BAT`, `.Bat`). An attacker can exploit this to run arbitrary commands on Windows systems by creating batch files with mixed-case extensions and injecting shell commands through the application arguments.

Technical details

This vulnerability is a command injection flaw (CWE-77) in Deno's command execution APIs. A prior patch (CVE-2025-61787) intended to block spawning Windows batch/shell files by validating that the spawned process path does not end with `.bat` or `.cmd`. The validation uses case-sensitive string comparison, checking only against lowercase literals. This allows attackers to bypass the check by using alternate casing (e.g., `.BAT`, `.Bat`). An attacker can call `Deno.Command()` with a batch file path using uppercase or mixed-case extension and pass shell metacharacters in the `args` parameter (e.g., `&calc.exe`), resulting in arbitrary command execution on the Windows system. The fix requires case-insensitive extension comparison. Patch available in Deno v2.5.6 and later.

Affected products

• Deno Deno < 2.5.6

Timeline

• 2026-01-16: disclosed: Advisory published
• 2026-01-15: patched: Fix released in Deno v2.5.6

References

• https://api.github.com/users/SharokhAtaie
• https://github.com/SharokhAtaie
• https://api.github.com/users/SharokhAtaie/gists%7B/gist_id%7D
• https://api.github.com/users/SharokhAtaie/repos
• https://avatars.githubusercontent.com/u/94289484?v=4
• https://api.github.com/users/SharokhAtaie/events%7B/privacy%7D