Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Before 2.5.6, a prior patch aimed to block spawning Windows batch/shell files by returning an error when a spawned path’s extension matched .bat or .cmd. That check performs a case-sensitive comparison against lowercase literals and therefore can be bypassed when the extension uses alternate casing (for example .BAT, .Bat, etc.). This vulnerability is fixed in 2.5.6.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
#VulnerabilityReport #CommandInjection Critical Deno Flaws Risk Secrets (CVE-2026-22863) & Execution (CVE-2026-22864) https://securityonline.info/critical-deno-flaws-risk-secrets-cve-2026-22863-execution-cve-2026-22864/?utm_source=dlvr.it&utm_medium=twitter
Post summary
The tweet announces critical command injection vulnerabilities in Deno (CVE-2026-22863 and CVE-2026-22864) and links to a detailed report.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | deno | deno | - | - | - |