deno/deno CVE-2026-22864: high 8.1

Incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass

Action: Upgrade deno to 2.5.6 or later.

Affected

Fixed versions

Sources

• deno-runtime: GHSA-m3c4-prhw-mrx6
• https://www.cve.org/CVERecord?id=CVE-2026-22864

CVE-2026-22864 · published 2026-01-15T22:40:52Z · modified 2026-01-15T22:40:52Z · JSON