CVE-2024-27932

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.8.0 and prior to version 1.40.4, Deno improperly checks that an import specifier's hostname is equal to or a child of a token's hostname, which can cause tokens to be sent to servers they shouldn't be sent to. An aut...

CVE-2024-27932

The CVE-2024-27932 issue affects Deno (JavaScript/TypeScript/Wasmtime runtime). The vulnerability arises from an improper check in the import descriptor hostname logic (in the auth_tokens.rs path) where a token hostname is not correctly constrained to its domain, allowing a token intended for exa...

CVE-2024-27932 Deno's improper suffix match testing for DENO_AUTH_TOKENS

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.8.0 and prior to version 1.40.4, Deno improperly checks that an import specifier's hostname is equal to or a child of a token's hostname, which can cause tokens to be sent to servers they shouldn't be sent to. An aut...