CVE-2023-28446

2023-03-2420:15:15

CWE-150

[email protected]

web.nvd.nist.gov

deno

javascript

typescript

runtime

rust

security

cve-2023-28446

vulnerability

patch

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.6 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

52.7%

JSON

Deno is a simple, modern and secure runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Arbitrary program names without any ANSI filtering allows any malicious program to clear the first 2 lines of a op_spawn_child or op_kill prompt and replace it with any desired text. This works with any command on the respective platform, giving the program the full ability to choose what program they wanted to run. This problem can not be exploited on systems that do not attach an interactive prompt (for example headless servers). This issue has been patched in version 1.31.2.

Affected configurations

Vulners

NVD

Node

denolanddenoRange1.8.0–1.31.2

CPENameOperatorVersion
deno:denodenolt1.31.2

CPE	Name	Operator	Version
deno:deno	deno	lt	1.31.2

CNA Affected

[
  {
    "vendor": "denoland",
    "product": "deno",
    "versions": [
      {
        "version": ">= 1.8.0, < 1.31.2",
        "status": "affected"
      }
    ]
  }
]