CVE-2026-49401: Deno Runtime Privilege Escalation Issue

CVE-2026-49401 Overview

CVE-2026-49401 is a permission bypass vulnerability in Deno, the JavaScript, TypeScript, and WebAssembly runtime. The flaw affects all versions prior to 2.7.14. Deno enforces filesystem and execution restrictions by comparing requested paths against values passed to --deny-read, --deny-write, --deny-run, and --deny-ffi. On macOS, this comparison runs at the raw-byte level, while the APFS filesystem treats different Unicode spellings of the same name as the same file. An attacker-controlled script can reach a denied path by spelling it differently than the deny rule. The issue is tracked under [CWE-41] and is fixed in Deno 2.7.14.

Critical Impact
Untrusted code running under Deno on macOS can bypass --deny-read, --deny-write, --deny-run, and --deny-ffi restrictions to access or modify files that the sandbox was configured to block.

Affected Products

Deno runtime versions prior to 2.7.14 on macOS
Applications relying on Deno deny-list permissions for sandboxing on APFS volumes
CI/CD pipelines and developer workstations executing untrusted Deno scripts on macOS

Discovery Timeline

2026-06-23 - CVE-2026-49401 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-49401

Vulnerability Analysis

Deno's permission model lets operators restrict a script's access to the filesystem and process execution using deny flags. When a script requests a resource, Deno compares the requested path to the deny-list entries as raw bytes. The check assumes that one canonical byte sequence represents one filesystem path.

APFS, the default macOS filesystem, breaks that assumption. APFS performs Unicode normalization, so two byte sequences that differ but normalize to the same code points refer to the same file. A path containing precomposed characters and a path containing the equivalent decomposed sequence resolve to the same on-disk object. Deno's byte-level comparator treats them as distinct strings and allows the request through.

Exploitation requires local code execution within the Deno runtime, but it defeats the sandbox boundary that operators rely on for least-privilege execution. The flaw is classified as [CWE-41] Improper Resolution of Path Equivalence.

Root Cause

The permission check uses byte-wise string comparison instead of Unicode-aware path equivalence. Because APFS canonicalizes filenames during filesystem operations, the kernel resolves a non-normalized spelling to the same inode as the denied path, while Deno's userspace check sees a different string and approves the operation.

Attack Vector

An attacker who can supply Deno source code to a target, for example through a malicious dependency, a build script, or a shared development tool, crafts file paths using alternate Unicode forms of the denied targets. When the script runs under flags such as --deny-read=/Users/victim/.ssh/id_ed25519, the attacker requests the same file using a decomposed or otherwise re-encoded spelling. Deno's permission layer permits the call, the macOS kernel normalizes the path through APFS, and the script reads, writes, executes, or loads the protected resource.

The vulnerability is described in the Deno GitHub Security Advisory. No verified public exploit code is available at the time of publication.

Detection Methods for CVE-2026-49401

Indicators of Compromise

Deno processes on macOS accessing files outside their documented allow-lists while deny flags are set
File access events where the requested path contains decomposed Unicode characters that normalize to a denied path
Unexpected reads of sensitive paths such as ~/.ssh, ~/.aws, or keychain-adjacent files by deno processes

Detection Strategies

Inventory macOS endpoints and developer hosts for Deno installations and flag any version prior to 2.7.14
Inspect command-line arguments of deno processes for the presence of --deny-read, --deny-write, --deny-run, or --deny-ffi to identify sandboxed workloads at risk
Correlate Deno process telemetry with filesystem events to surface access to paths that should be denied by policy

Monitoring Recommendations

Forward macOS Endpoint Security Framework file and process events to a central analytics platform for path-level review
Alert on Deno child processes launched with --allow-* and --deny-* flags accessing high-value directories
Track installations of the deno binary through package managers such as Homebrew and the official installer for version drift

How to Mitigate CVE-2026-49401

Immediate Actions Required

Upgrade Deno to version 2.7.14 or later on every macOS host that executes untrusted or partially trusted code
Audit CI/CD runners, container base images, and developer machines for older Deno binaries and replace them
Re-evaluate any security controls that depend solely on Deno deny flags until patched runtimes are deployed

Patch Information

The Deno maintainers fixed the vulnerability in release 2.7.14. The patch changes the permission check to use a path-equivalence comparison that accounts for Unicode normalization on macOS. Refer to the Deno GitHub Security Advisory GHSA-8xpq-cjcf-3wh9 for release notes and commit references.

Workarounds

Run Deno workloads on Linux hosts where APFS Unicode normalization does not apply, until upgrading to 2.7.14
Combine Deno deny flags with operating system level controls such as macOS sandbox profiles or filesystem ACLs on sensitive directories
Avoid executing untrusted Deno scripts on macOS with permission flags as the only boundary; isolate them in dedicated virtual machines or containers

bash

# Verify and upgrade Deno to a patched release on macOS
deno --version
brew update && brew upgrade deno
# Or reinstall via the official installer
curl -fsSL https://deno.land/install.sh | sh
deno --version   # confirm output reports 2.7.14 or later