https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T22:53:03.262076+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-343241 EUVD-2026-343241 2026-10-05T22:53:03.308032+00:00 EUVD-2026-343241 https://cve.radiocsirt.org/vuln/fkie_cve-2026-49401 fkie_cve-2026-49401 2026-10-05T22:53:03.308067+00:00

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.14, Deno's permission system enforces filesystem and execution restrictions by comparing the requested path against the path supplied to --deny-read, --deny-write, --deny-run, or --deny-ffi. On macOS, that comparison was done at the raw-byte level while the APFS filesystem treats different Unicode spellings of the same name as the same file. That means a program could reach a denied path by spelling it differently than the deny rule. This vulnerability is fixed in 2.7.14.

 https://cve.radiocsirt.org/vuln/ghsa-8xpq-cjcf-3wh9 GHSA-8xpq-cjcf-3wh9 — Deno: Permission Bypass via Unicode Normalization Mismatch on macOS (APFS) 2026-10-05T22:53:03.308102+00:00

Affected: crates.io: deno

## Summary

Deno's permission system enforces filesystem and execution restrictions by comparing the requested path against the path supplied to `--deny-read`, `--deny-write`, `--deny-run`, or `--deny-ffi`. On macOS, that comparison was done at the raw-byte level while the APFS filesystem treats different Unicode spellings of the same name as the same file.

That means a program could reach a denied path by spelling it differently than the deny rule. For example, with `--deny-read=/secrets/passwörter.txt`, a script could still read the file by opening `/secrets/passwo\u0308rter.txt` (NFD instead of NFC), or `/SECRETS/PASSWÖRTER.txt` (different case, since default APFS volumes are case-insensitive). Other forms include ligature characters (`fi` vs `fi`, `ff` vs `ff`, …) and German `ß` vs `ss`.

The denied path and the requested path differed at the byte level, so Deno's permission check passed; the kernel then resolved them to the same inode and served the file anyway. The same flaw affected `--deny-write`, `--deny-run`, and `--deny-ffi`, which share the same path-comparison code.

## Am I affected?

You are potentially affected if **all** of the following are true:

1. You run Deno on **macOS** (the issue is specific to APFS path-equivalence rules; Linux and Windows are not affected by this variant). 2. You rely on `--deny-read`, `--deny-write`, `--deny-run`, or `--deny-ffi` as a security boundary against less-trusted code — a dependency, plugin, or attacker-controlle…