# CVE-2026-22864: Deno command injection via case-insensitive extension bypass on Windows

Source: https://junglewise.ai/threats/cve-2026-22864-deno-command-injection-via-case-insensitive-extension-bypass-on  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-16. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-22864 · Severity: high · CVSS 8.1 · Published 2026-01-16

Deno is a JavaScript runtime used for building server-side applications. A previous security fix attempted to block execution of Windows batch files to prevent command injection attacks. However, the fix contains a flaw: it only blocks extensions written in lowercase (`.bat` and `.cmd`), but fails to block uppercase or mixed-case variants (`.BAT`, `.Bat`). An attacker can exploit this to run arbitrary commands on Windows systems by creating batch files with mixed-case extensions and injecting shell commands through the application arguments.

Technologies: [deno (crates.io)](https://junglewise.ai/threats/technologies/deno). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io).

## Quick answers

**Is CVE-2026-22864 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-22864 being exploited in the wild.

**How severe is CVE-2026-22864?** High severity, with a CVSS score of 8.1, published 16 January 2026.

**Which products and versions are affected?** deno (crates.io) < 2.5.6, SEMVER:introduced=0,fixed=2.5.6.

**Is there a fix for CVE-2026-22864?** Yes. deno (crates.io): upgrade to 2.5.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-22864 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-22864?** Check whether you run deno (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- deno (crates.io): upgrade to 2.5.6 or later

  ```sh
  cargo update -p deno
  ```


## Technical details

This vulnerability is a command injection flaw (CWE-77) in Deno's command execution APIs. A prior patch (CVE-2025-61787) intended to block spawning Windows batch/shell files by validating that the spawned process path does not end with `.bat` or `.cmd`. The validation uses case-sensitive string comparison, checking only against lowercase literals. This allows attackers to bypass the check by using alternate casing (e.g., `.BAT`, `.Bat`). An attacker can call `Deno.Command()` with a batch file path using uppercase or mixed-case extension and pass shell metacharacters in the `args` parameter (e.g., `&calc.exe`), resulting in arbitrary command execution on the Windows system. The fix requires case-insensitive extension comparison. Patch available in Deno v2.5.6 and later.

## Affected products

- Deno Deno < 2.5.6

## Identifiers

- CVE-2026-22864
- GHSA-m3c4-prhw-mrx6

## Timeline

- 2026-01-16: disclosed: Advisory published
- 2026-01-15: patched: Fix released in Deno v2.5.6

## References

- [https://api.github.com/users/SharokhAtaie](https://api.github.com/users/SharokhAtaie)
- [https://github.com/SharokhAtaie](https://github.com/SharokhAtaie)
- [https://api.github.com/users/SharokhAtaie/gists%7B/gist_id%7D](https://api.github.com/users/SharokhAtaie/gists%7B/gist_id%7D)
- [https://api.github.com/users/SharokhAtaie/repos](https://api.github.com/users/SharokhAtaie/repos)
- [https://avatars.githubusercontent.com/u/94289484?v=4](https://avatars.githubusercontent.com/u/94289484?v=4)
- [https://api.github.com/users/SharokhAtaie/events%7B/privacy%7D](https://api.github.com/users/SharokhAtaie/events%7B/privacy%7D)

## Related threats

- [Deno denial of service via non-ASCII WebSocket response headers](https://junglewise.ai/threats/cve-2026-55517-deno-denial-of-service-via-non-ascii-websocket-response-headers)
- [Deno environment permission bypass in process.loadEnvFile](https://junglewise.ai/threats/cve-2026-49983-deno-environment-permission-bypass-in-process-loadenvfile)
- [Deno sandbox bypass via missing post-DNS check in WebSocket API](https://junglewise.ai/threats/cve-2026-49860-deno-sandbox-bypass-via-missing-post-dns-check-in-websocket-api)
- [Deno network restriction bypass in fetch API](https://junglewise.ai/threats/cve-2026-49859-deno-network-restriction-bypass-in-fetch-api)
- [Deno missing cryptographic rounds in node:crypto checkPrime](https://junglewise.ai/threats/cve-2026-49440-deno-missing-cryptographic-rounds-in-node-crypto-checkprime)