CVE-2026-22864

CVE-2026-22864 is a critical vulnerability affecting Deno, a JavaScript, TypeScript, and WebAssembly runtime, specifically versions prior to 2.5.6. It allows for a bypass of a security patch intended to block the spawning of Windows batch/shell files. The original patch performed a case-sensitive comparison of file extensions, enabling attackers to execute malicious scripts by using alternate casing (e.g., .BAT instead of .bat). This vulnerability carries a CVSS score of 9.8 (CRITICAL), indicating a severe risk. It has a network attack vector, low attack complexity, and requires no user interaction or privileges, potentially leading to complete compromise of confidentiality, integrity, and availability. Currently, there is no evidence of active exploitation, nor are there publicly available exploits in Metasploit, Nuclei, or ExploitDB. While there is minimal community discussion, the vulnerability is not listed on the CISA KEV catalog, suggesting it is not yet widely exploited in the wild.