https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T08:35:23.027141+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-265945 EUVD-2026-265945 2026-10-06T08:35:23.030183+00:00 EUVD-2026-265945 https://cve.radiocsirt.org/vuln/fkie_cve-2026-22864 fkie_cve-2026-22864 2026-10-06T08:35:23.030219+00:00

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Before 2.5.6, a prior patch aimed to block spawning Windows batch/shell files by returning an error when a spawned path’s extension matched .bat or .cmd. That check performs a case-sensitive comparison against lowercase literals and therefore can be bypassed when the extension uses alternate casing (for example .BAT, .Bat, etc.). This vulnerability is fixed in 2.5.6.

 https://cve.radiocsirt.org/vuln/ghsa-m3c4-prhw-mrx6 GHSA-m3c4-prhw-mrx6 — Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass 2026-10-06T08:35:23.030260+00:00

Affected: crates.io: deno

### Summary A prior patch aimed to block spawning Windows batch/shell files by returning an error when a spawned path’s extension matched `.bat` or `.cmd`. That check performs a case-sensitive comparison against lowercase literals and therefore can be bypassed when the extension uses alternate casing (for example `.BAT, .Bat`, etc.).

### POC ```javascript const command = new Deno.Command('./test.BAT', { args: ['&calc.exe'], }); const child = command.spawn(); ``` This causes `calc.exe` to be launched; see the attached screenshot for evidence.

**Patched in `CVE-2025-61787` — prevents execution of `.bat` and `.cmd` files:** ![photo_2025-10-10 02 27 23](https://github.com/user-attachments/assets/43df25e2-e2e1-48aa-8060-cb0a22637f1f)

**Bypass of the patched vulnerability:** ![photo_2025-10-10 02 27 25](https://github.com/user-attachments/assets/2be1afb4-84a1-4883-8e18-6a174fdd3615)

### Impact The script launches calc.exe on Windows, demonstrating that passing user-controlled arguments to a spawned batch script can result in command-line injection.

### Mitigation

Users should update to Deno v2.5.6 or newer.