A case-sensitive check intended to block Windows batch files only compares against lowercase literals, allowing attackers to bypass it by using alternate casing such as .BAT or .Bat. This flaw enables spawning of arbitrary Windows shell commands, resulting in remote code execution. The weakness aligns with CWE-77, known for command injection scenarios.

Deno, the JavaScript/TypeScript runtime, is affected in all releases prior to version 2.5.6. Updating to 2.5.6 or later resolves the issue.

The CVSS score of 8.1 indicates high severity, while the EPSS of less than 1% suggests a low yet non-zero likelihood of exploitation. Because the flaw permits arbitrary command execution on Windows when an untrusted path is passed to spawn, an attacker who can influence the spawned path—such as through a remote code execution vector or local privilege—could elevate privileges or take full control of the host. The vulnerability is not listed in the CISA KEV catalog, but the high impact and potential for widespread exploitation warrant immediate attention.