https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 07:58:07 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-265945 EUVD-2026-265945 https://cve.radiocsirt.org/vuln/euvd-2026-265945 https://cve.radiocsirt.org/vuln/fkie_cve-2026-22864 <p>Deno is a JavaScript, TypeScript, and WebAssembly runtime. Before 2.5.6, a prior patch aimed to block spawning Windows batch/shell files by returning an error when a spawned path’s extension matched .bat or .cmd. That check performs a case-sensitive comparison against lowercase literals and therefore can be bypassed when the extension uses alternate casing (for example .BAT, .Bat, etc.). This vulnerability is fixed in 2.5.6.</p> <p>Deno is a JavaScript, TypeScript, and WebAssembly runtime. Before 2.5.6, a prior patch aimed to block spawning Windows batch/shell files by returning an error when a spawned path’s extension matched .bat or .cmd. That check performs a case-sensitive comparison against lowercase literals and therefore can be bypassed when the extension uses alternate casing (for example .BAT, .Bat, etc.). This vulnerability is fixed in 2.5.6.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-22864 https://cve.radiocsirt.org/vuln/ghsa-m3c4-prhw-mrx6 <p><strong>Affected:</strong> crates.io: deno</p> <p>### Summary A prior patch aimed to block spawning Windows batch/shell files by returning an error when a spawned path’s extension matched `.bat` or `.cmd`. That check performs a case-sensitive comparison against lowercase literals and therefore can be bypassed when the extension uses alternate casing (for example `.BAT, .Bat`, etc.).</p> <p>### POC ```javascript const command = new Deno.Command(&#39;./test.BAT&#39;, { args: [&#39;&amp;calc.exe&#39;], }); const child = command.spawn(); ``` This causes `calc.exe` to be launched; see the attached screenshot for evidence.</p> <p>**Patched in `CVE-2025-61787` — prevents execution of `.bat` and `.cmd` files:** </p> <p>**Bypass of the patched vulnerability:** </p> <p>### Impact The script launches calc.exe on Windows, demonstrating that passing user-controlled arguments to a spawned batch script can result in command-line injection.</p> <p>### Mitigation</p> <p>Users should update to Deno v2.5.6 or newer.</p> <p><strong>Affected:</strong> crates.io: deno</p> <p>### Summary A prior patch aimed to block spawning Windows batch/shell files by returning an error when a spawned path’s extension matched `.bat` or `.cmd`. That check performs a case-sensitive comparison against lowercase literals and therefore can be bypassed when the extension uses alternate casing (for example `.BAT, .Bat`, etc.).</p> <p>### POC ```javascript const command = new Deno.Command(&#39;./test.BAT&#39;, { args: [&#39;&amp;calc.exe&#39;], }); const child = command.spawn(); ``` This causes `calc.exe` to be launched; see the attached screenshot for evidence.</p> <p>**Patched in `CVE-2025-61787` — prevents execution of `.bat` and `.cmd` files:** </p> <p>**Bypass of the patched vulnerability:** </p> <p>### Impact The script launches calc.exe on Windows, demonstrating that passing user-controlled arguments to a spawned batch script can result in command-line injection.</p> <p>### Mitigation</p> <p>Users should update to Deno v2.5.6 or newer.</p> https://cve.radiocsirt.org/vuln/ghsa-m3c4-prhw-mrx6