Lucene search

K

21 matches found

CVE
CVE
added 2023/01/17 9:15 p.m.349 views

CVE-2023-22499

Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Multi-threaded programs were able to spoof interactive permission prompt by rewriting the prompt to suggest that program is waiting on user confirmation to unrelated action. A malicious program could clear the termin...

7.5CVSS7.3AI score0.0007EPSS
CVE
CVE
added 2024/06/06 4:15 p.m.211 views

CVE-2024-37150

An issue in .npmrc support in Deno 1.44.0 was discovered where Deno would send .npmrc credentials for the scope to the tarball URL when the registry provided URLs for a tarball on a different domain. All users relying on .npmrc are potentially affected by this vulnerability if their private registr...

7.6CVSS6.8AI score0.00219EPSS
CVE
CVE
added 2022/03/25 10:15 p.m.86 views

CVE-2022-24783

Deno is a runtime for JavaScript and TypeScript. The versions of Deno between release 1.18.0 and 1.20.2 (inclusive) are vulnerable to an attack where a malicious actor controlling the code executed in a Deno runtime could bypass all permission checks and execute arbitrary shell code. This vulnerabi...

10CVSS9.7AI score0.00344EPSS
CVE
CVE
added 2024/03/21 2:52 a.m.85 views

CVE-2024-27933

Deno is a JavaScript, TypeScript, and WebAssembly runtime. In version 1.39.0, use of raw file descriptors in op_node_ipc_pipe() leads to premature close of arbitrary file descriptors, allowing standard input to be re-opened as a different resource resulting in permission prompt bypass. Node child_p...

8.8CVSS8.4AI score0.00016EPSS
CVE
CVE
added 2021/05/28 9:15 p.m.80 views

CVE-2021-32619

Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. In Deno versions 1.5.0 to 1.10.1, modules that are dynamically imported through import() or new Worker might have been able to bypass network and file system permission checks when statically importing other modules....

9.8CVSS9.6AI score0.00363EPSS
CVE
CVE
added 2024/03/05 5:15 p.m.70 views

CVE-2024-27931

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. Insufficient validation of parameters in Deno.makeTemp* APIs would allow for creation of files outside of the allowed directories. This may allow the user to overwrite important files on the system that may affect other...

6.5CVSS5.5AI score0.00226EPSS
CVE
CVE
added 2024/03/21 2:52 a.m.68 views

CVE-2024-27936

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. Starting in version 1.32.1 and prior to version 1.41.0 of the deno library, maliciously crafted permission request can show the spoofed permission prompt by inserting a broken ANSI escape sequence into the request conte...

8.8CVSS8.6AI score0.0052EPSS
CVE
CVE
added 2024/03/21 2:52 a.m.66 views

CVE-2024-27935

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.35.1 and prior to version 1.36.3, a vulnerability in Deno's Node.js compatibility runtime allows for cross-session data contamination during simultaneous asynchronous reads from Node.js streams sourced from sockets or ...

8.3CVSS7.2AI score0.00234EPSS
CVE
CVE
added 2024/03/21 2:52 a.m.64 views

CVE-2024-27934

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.36.2 and prior to version 1.40.3, use of inherently unsafe *const c_void and ExternalPointer leads to use-after-free access of the underlying structure, resulting in arbitrary code execution. Use of inherently unsafe *...

8.8CVSS8.8AI score0.00288EPSS
CVE
CVE
added 2023/03/24 12:15 a.m.56 views

CVE-2023-28445

Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Resizable ArrayBuffers passed to asynchronous functions that are shrunk during the asynchronous operation could result in an out-of-bound read/write. It is unlikely that this has been exploited in the wild, as the on...

9.9CVSS9.4AI score0.00283EPSS
CVE
CVE
added 2024/04/18 8:15 p.m.55 views

CVE-2024-32477

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. By using ANSI escape sequences and a race between libc::tcflush(0, libc::TCIFLUSH) and reading standard input, it's possible to manipulate the permission prompt and force it to allow an unsafe action regardless of the u...

7.7CVSS6.6AI score0.00019EPSS
CVE
CVE
added 2022/06/12 1:15 p.m.54 views

CVE-2021-41641

Deno

8.4CVSS8.6AI score0.00128EPSS
CVE
CVE
added 2024/03/21 2:52 a.m.54 views

CVE-2024-27932

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.8.0 and prior to version 1.40.4, Deno improperly checks that an import specifier's hostname is equal to or a child of a token's hostname, which can cause tokens to be sent to servers they shouldn't be sent to. An auth ...

4.6CVSS4.6AI score0.00609EPSS
CVE
CVE
added 2025/06/04 8:15 p.m.53 views

CVE-2025-48934

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to versions 2.1.13 and 2.2.13, the Deno.env.toObject method ignores any variables listed in the --deny-env option of the deno run command. When looking at the documentation of the --deny-env option this might lead to a false impressio...

6.9CVSS6.5AI score0.00058EPSS
CVE
CVE
added 2024/05/07 9:15 p.m.51 views

CVE-2024-34346

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. The Deno sandbox may be unexpectedly weakened by allowing file read/write access to privileged files in various locations on Unix and Windows platforms. For example, reading /proc/self/environ may provide access equival...

8.4CVSS6.9AI score0.00035EPSS
CVE
CVE
added 2023/02/25 5:15 a.m.48 views

CVE-2023-26103

Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket function, which contains regexes in the form of /s*,s*/, used for splitting the Connection/Upgrade header. A specially crafted Connection/Upgrade header can be used ...

7.5CVSS7.5AI score0.00092EPSS
CVE
CVE
added 2025/06/03 11:15 p.m.42 views

CVE-2025-24015

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions 1.46.0 through 2.1.6 have an issue that affects AES-256-GCM and AES-128-GCM in Deno in which the authentication tag is not being validated. This means tampered ciphertexts or incorrect keys might not be detected, which breaks the g...

8.7CVSS6.6AI score0.00087EPSS
CVE
CVE
added 2025/06/04 8:15 p.m.39 views

CVE-2025-48888

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.41.3 and prior to versions 2.1.13, 2.2.13, and 2.3.2, deno run --allow-read --deny-read main.ts results in allowed, even though 'deny' should be stronger. The result is the same with all global unary permissions given ...

6.9CVSS6.5AI score0.00046EPSS
CVE
CVE
added 2023/03/24 8:15 p.m.38 views

CVE-2023-28446

Deno is a simple, modern and secure runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Arbitrary program names without any ANSI filtering allows any malicious program to clear the first 2 lines of a op_spawn_child or op_kill prompt and replace it with any desired text. This wo...

8.8CVSS8.7AI score0.0124EPSS
CVE
CVE
added 2023/05/31 6:15 p.m.37 views

CVE-2023-33966

Deno is a runtime for JavaScript and TypeScript. In deno 1.34.0 and deno_runtime 0.114.0, outbound HTTP requests made using the built-in node:http or node:https modules are incorrectly not checked against the network permission allow list (--allow-net). Dependencies relying on these built-in module...

9.8CVSS9.2AI score0.00141EPSS
CVE
CVE
added 2025/06/04 8:15 p.m.37 views

CVE-2025-48935

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 2.2.0 and prior to versions 2.2.5, it is possible to bypass Deno's permission read/write db permission check by using ATTACH DATABASE statement. Version 2.2.5 contains a patch for the issue.

9.1CVSS6.9AI score0.00058EPSS