CVE-2026-49401 Details

A vulnerability in Deno's permission system prior to version 2.7.14 allows for a bypass of filesystem and execution restrictions on macOS. The issue arises because the permission checks compare paths at the raw-byte level, while the APFS filesystem treats different Unicode representations of the same name as identical. This discrepancy enables a program to access denied paths by using an alternate spelling that evades the deny rules. For instance, with a deny-read rule for a file named 'passwörter.txt', a script could read the file by opening it with a different Unicode normalization or case variation. The vulnerability affects all paths with characters that have multiple Unicode spellings, as well as those relying on case sensitivity, due to APFS's default case-insensitivity.

Users can upgrade to Deno version 2.7.14 or later, where this vulnerability is fixed. If an immediate upgrade is not possible, it is recommended to use allowlists instead of denylists for permission management and to avoid relying on case sensitivity for security on default APFS volumes.