CVE-2021-41641

Deno =1.14.0 file sandbox does not handle symbolic links correctly. When running Deno with specific write access, the Deno.symlink method can be used to gain access to any directory...

CVE-2026-21895 vulnerabilities

Vulnerabilities for packages: lychee, sqlx, atuin, vector, zed, qdrant, deno, sccache, yara-x...

CVE-2026-21895 vulnerabilities

Vulnerabilities for packages: yara-x, deno, vector, lychee, atuin, sccache, zed, sqlx, uv, qdrant...

CVE-2025-4574 vulnerabilities

Vulnerabilities for packages: oranda, cargo-audit, lychee, starship, rust-analyzer, wasmcloud, cargo-c, oxipng, nushell, ruff, yara-x, zed, wadm, pixi, deno, samply, fd, yazi...

CVE-2025-4574 vulnerabilities

Vulnerabilities for packages: pixi, deno, wasmcloud, starship, ztunnel, cargo-c, zed, samply, yara-x, rust-analyzer, oxipng, cargo-audit, wadm, nushell, oranda, lychee, yazi, ruff, fd, ztunnel-fips...

SUSE CVE-2025-64718

js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution proto. All users who parse untrusted yaml documents may be impacted. The problem is patched in...

EUVD-2025-175314

js-yaml has prototype pollution in merge...

Prototype Pollution

Overview org.webjars.npm:js-yaml is a human-friendly data serialization language. Affected versions of this package are vulnerable to Prototype Pollution via the merge function. An attacker can alter object prototypes by supplying specially crafted YAML documents containing proto properties. This...

Prototype Pollution

Overview js-yaml is a human-friendly data serialization language. Affected versions of this package are vulnerable to Prototype Pollution via the merge function. An attacker can alter object prototypes by supplying specially crafted YAML documents containing proto properties. This can lead to...

CVE-2025-64718

CVE-2025-64718 affects js-yaml, allowing prototype pollution via proto when parsing untrusted YAML. The issue is patched in js-yaml 4.1.1 and in 3.14.2. Public IBM bulletins confirm usage of vulnerable js-yaml versions in IBM Maximo components and recommend upgrading to a fixed release (e.g., js-...

CVE-2025-61787

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions prior to 2.5.3 and 2.2.15 are vulnerable to Command Line Injection attacks on Windows when batch files are executed. In Windows, CreateProcess always implicitly spawns cmd.exe if a batch file .bat, .cmd, etc. is being executed ev...

CVE-2025-61786

Deno is a JavaScript, TypeScript, and WebAssembly runtime. In versions prior to 2.5.3 and 2.2.15, Deno.FsFile.prototype.stat and Deno.FsFile.prototype.statSync are not limited by the permission model check --deny-read=./. It's possible to retrieve stats from files that the user do not have explic...

CVE-2025-61785

Deno is a JavaScript, TypeScript, and WebAssembly runtime. In versions prior to 2.5.3 and 2.2.15, Deno.FsFile.prototype.utime and Deno.FsFile.prototype.utimeSync are not limited by the permission model check --deny-write=./. It's possible to change to change the access atime and modification mtim...

deno_cli (>=0.18.0-preview4 <=0.23.0), deno_cli_snapshots (>=0.0.3 <=0.19.0) +2 more potentially affected by CVE-2025-61787 via deno (>=0.15.0 <=0.6.0)

deno CARGO version =0.15.0, =0.18.0-preview4, =0.0.3, =0.0.1, =0.23.0 Source cves: CVE-2025-61787 Source advisory: OSV:GHSA-M2GF-X3F6-8HQ3...

GHSA-M2GF-X3F6-8HQ3 Deno is Vulnerable to Command Injection on Windows During Batch File Execution

Summary Deno versions up to 2.5.1 are vulnerable to Command Line Injection attacks on Windows when batch files are executed. Details In Windows, CreateProcess always implicitly spawns cmd.exe if a batch file .bat, .cmd, etc. is being executed even if the application does not specify it via the...

Deno is Vulnerable to Command Injection on Windows During Batch File Execution

Summary Deno versions up to 2.5.1 are vulnerable to Command Line Injection attacks on Windows when batch files are executed. Details In Windows, CreateProcess always implicitly spawns cmd.exe if a batch file .bat, .cmd, etc. is being executed even if the application does not specify it via the...

deno_cli (>=0.18.0-preview4 <=0.23.0), deno_cli_snapshots (>=0.0.3 <=0.19.0) +2 more potentially affected by CVE-2025-61786 via deno (>=0.15.0 <=0.6.0)

deno CARGO version =0.15.0, =0.18.0-preview4, =0.0.3, =0.0.1, =0.23.0 Source cves: CVE-2025-61786 Source advisory: OSV:GHSA-QQ26-84MH-26J9...

GHSA-QQ26-84MH-26J9 Deno's --deny-read check does not prevent permission bypass

Summary Deno.FsFile.prototype.stat and Deno.FsFile.prototype.statSync are not limited by the permission model check --deny-read=./. It's possible to retrieve stats from files that the user do not have explicit read access to the script is executed with --deny-read=./ Similar APIs like Deno.stat a...

Deno's --deny-read check does not prevent permission bypass

Summary Deno.FsFile.prototype.stat and Deno.FsFile.prototype.statSync are not limited by the permission model check --deny-read=./. It's possible to retrieve stats from files that the user do not have explicit read access to the script is executed with --deny-read=./ Similar APIs like Deno.stat a...

CVE-2025-61786

Deno is a JavaScript, TypeScript, and WebAssembly runtime. In versions prior to 2.5.3 and 2.2.15, Deno.FsFile.prototype.stat and Deno.FsFile.prototype.statSync are not limited by the permission model check --deny-read=./. It's possible to retrieve stats from files that the user do not have explic...