Executive brief
Deno is a software runtime used to execute JavaScript and TypeScript applications. A security flaw on macOS allowed programs to bypass restricted file and execution permissions by using alternative Unicode spellings or different letter casing for file paths. This could allow a malicious script to read, write, or execute sensitive files that were explicitly supposed to be blocked by the system's security rules.
Technical details
A path equivalence vulnerability exists in Deno's permission system on macOS (APFS). The runtime performed raw-byte comparisons for filesystem and execution restrictions (e.g., --deny-read, --deny-run) while the underlying APFS filesystem treats different Unicode normalizations (NFC vs NFD) and case variations as the same file. An attacker with local execution privileges can bypass these 'deny' rules by requesting a path that is byte-different but functionally equivalent to a restricted path (e.g., using ligatures, accented characters, or different casing). This issue is specific to macOS and has been resolved in version 2.7.14 by implementing NFC normalization and Unicode case folding during path comparison.
Affected products
- denoland Deno < 2.7.14
Timeline
- 2026-05-27: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: NVD publication date