CVE-2026-22864: Deno command injection via case-insensitive extension bypass on Windows

CVE-2026-22864 · Severity: high · CVSS 8.1 · Published 2026-01-16

Deno is a JavaScript runtime used for building server-side applications. A previous security fix attempted to block execution of Windows batch files to prevent command injection attacks. However, the fix contains a flaw: it only blocks extensions written in lowercase (`.bat` and `.cmd`), but fails to block uppercase or mixed-case variants (`.BAT`, `.Bat`). An attacker can exploit this to run arbitrary commands on Windows systems by creating batch files with mixed-case extensions and injecting shell commands through the application arguments.

Technologies: deno (crates.io). Vendors: crates.io.

Quick answers

Is CVE-2026-22864 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-22864 being exploited in the wild.
How severe is CVE-2026-22864?
High severity, with a CVSS score of 8.1, published 16 January 2026.
Which products and versions are affected?
deno (crates.io) < 2.5.6, SEMVER:introduced=0,fixed=2.5.6.
Is there a fix for CVE-2026-22864?
Yes. deno (crates.io): upgrade to 2.5.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-22864 attacked?
It is attacked over the network.
Am I affected by CVE-2026-22864?
Check whether you run deno (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • deno (crates.io): upgrade to 2.5.6 or later
    cargo update -p deno

Technical details

This vulnerability is a command injection flaw (CWE-77) in Deno's command execution APIs. A prior patch (CVE-2025-61787) intended to block spawning Windows batch/shell files by validating that the spawned process path does not end with `.bat` or `.cmd`. The validation uses case-sensitive string comparison, checking only against lowercase literals. This allows attackers to bypass the check by using alternate casing (e.g., `.BAT`, `.Bat`). An attacker can call `Deno.Command()` with a batch file path using uppercase or mixed-case extension and pass shell metacharacters in the `args` parameter (e.g., `&calc.exe`), resulting in arbitrary command execution on the Windows system. The fix requires case-insensitive extension comparison. Patch available in Deno v2.5.6 and later.

Affected products

  • Deno Deno < 2.5.6

Identifiers

  • CVE-2026-22864
  • GHSA-m3c4-prhw-mrx6

Timeline

  • 2026-01-16: disclosed: Advisory published
  • 2026-01-15: patched: Fix released in Deno v2.5.6

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.