CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2023-33966 – Deno missing "--allow-net" permission check for built-in Node modules
https://notcve.org/view.php?id=CVE-2023-33966
31 May 2023 — Deno is a runtime for JavaScript and TypeScript. In deno 1.34.0 and deno_runtime 0.114.0, outbound HTTP requests made using the built-in `node:http` or `node:https` modules are incorrectly not checked against the network permission allow list (`--allow-net`). Dependencies relying on these built-in modules are subject to the vulnerability too. Users of Deno versions prior to 1.34.0 are unaffected. Deno Deploy users are unaffected. • https://github.com/denoland/deno/releases/tag/v1.34.1 • CWE-269: Improper Privilege Management CWE-276: Incorrect Default Permissions •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2023-28446 – Deno is vulnerable to interactive `run` permission prompt spoofing via improper ANSI neutralization
https://notcve.org/view.php?id=CVE-2023-28446
24 Mar 2023 — Deno is a simple, modern and secure runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Arbitrary program names without any ANSI filtering allows any malicious program to clear the first 2 lines of a `op_spawn_child` or `op_kill` prompt and replace it with any desired text. This works with any command on the respective platform, giving the program the full ability to choose what program they wanted to run. This problem can not be exploited on systems that do not attach an interactive pr... • https://github.com/denoland/deno/blob/7d13d65468c37022f003bb680dfbddd07ea72173/runtime/js/40_process.js#L175 • CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences •
CVSS: 10.0EPSS: 0%CPEs: 3EXPL: 0CVE-2023-28445 – Deno improperly handles resizable ArrayBuffer
https://notcve.org/view.php?id=CVE-2023-28445
23 Mar 2023 — Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Resizable ArrayBuffers passed to asynchronous functions that are shrunk during the asynchronous operation could result in an out-of-bound read/write. It is unlikely that this has been exploited in the wild, as the only version affected is Deno 1.32.0. Deno Deploy users are not affected. The problem has been resolved by disabling resizable ArrayBuffers temporarily in Deno 1.32.1. • https://github.com/denoland/deno/pull/18395 • CWE-125: Out-of-bounds Read CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-26103
https://notcve.org/view.php?id=CVE-2023-26103
25 Feb 2023 — Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket function, which contains regexes in the form of /s*,s*/, used for splitting the Connection/Upgrade header. A specially crafted Connection/Upgrade header can be used to significantly slow down a web socket server. • https://github.com/denoland/deno/blob/2b247be517d789a37e532849e2e40b724af0918f/ext/http/01_http.js%23L395-L409 • CWE-1333: Inefficient Regular Expression Complexity •
CVSS: 7.6EPSS: 0%CPEs: 1EXPL: 1CVE-2023-22499 – Interactive permission prompt spoofing in Deno
https://notcve.org/view.php?id=CVE-2023-22499
17 Jan 2023 — Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Multi-threaded programs were able to spoof interactive permission prompt by rewriting the prompt to suggest that program is waiting on user confirmation to unrelated action. A malicious program could clear the terminal screen after permission prompt was shown and write a generic message. This situation impacts users who use Web Worker API and relied on interactive permission prompt. The reproduction is very timing sensitive a... • https://github.com/denoland/deno/pull/17392 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 8.4EPSS: 0%CPEs: 1EXPL: 2CVE-2021-41641
https://notcve.org/view.php?id=CVE-2021-41641
12 Jun 2022 — Deno <=1.14.0 file sandbox does not handle symbolic links correctly. When running Deno with specific write access, the Deno.symlink method can be used to gain access to any directory. Deno versiones anteriores a 1.14.0 incluyéndola, el sandbox de archivo no maneja correctamente los enlaces simbólicos. Cuando es ejecutado Deno con un acceso de escritura específico, el método Deno.symlink puede usarse para acceder a cualquier directorio • https://github.com/denoland/deno/issues/12152 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-24783 – Sandbox bypass leading to arbitrary code execution in Deno
https://notcve.org/view.php?id=CVE-2022-24783
25 Mar 2022 — Deno is a runtime for JavaScript and TypeScript. The versions of Deno between release 1.18.0 and 1.20.2 (inclusive) are vulnerable to an attack where a malicious actor controlling the code executed in a Deno runtime could bypass all permission checks and execute arbitrary shell code. This vulnerability does not affect users of Deno Deploy. The vulnerability has been patched in Deno 1.20.3. There is no workaround. • https://github.com/denoland/deno/security/advisories/GHSA-838h-jqp6-cf2f • CWE-269: Improper Privilege Management CWE-863: Incorrect Authorization •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-32619 – Static imports inside dynamically imported modules do not adhere to permission checks
https://notcve.org/view.php?id=CVE-2021-32619
28 May 2021 — Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. In Deno versions 1.5.0 to 1.10.1, modules that are dynamically imported through `import()` or `new Worker` might have been able to bypass network and file system permission checks when statically importing other modules. The vulnerability has been patched in Deno release 1.10.2. Deno es un tiempo de ejecución para JavaScript y TypeScript que usa V8 y está construido en Rust. En versiones 1.5.0 hasta 1.10.1 de Deno, los m... • https://github.com/denoland/deno/security/advisories/GHSA-xpwj-7v8q-mcgj • CWE-285: Improper Authorization CWE-863: Incorrect Authorization •