Deno
Monthly
Command injection in Deno 2.7.0 through 2.9.7 on Windows allows an attacker who controls arguments passed to node:child_process spawn/exec calls with the shell option enabled to execute arbitrary OS commands with the privileges of the Deno process. The root cause is that Deno applied cmd.exe quoting rules to every shell, so arguments escaped for cmd.exe are reinterpreted as syntax by PowerShell/pwsh, a custom bash.exe, or another POSIX-style shell running on Windows. Exploitation requires a specific, non-default developer-chosen pattern - untrusted arguments plus the shell option on a Windows host, which is why the assessed vector carries AC:H/AT:P - and no public exploit has been identified at time of analysis, although the vendor has published an upstream fix in PR 36772.
Deno versions 2.7.0 through 2.7.1 contain a command injection vulnerability in the node:child_process polyfill where improper quote handling allows attackers to bypass previous security fixes and execute arbitrary OS commands through shell metacharacter injection in spawn/spawnSync arguments. This vulnerability bypasses Deno's permission system entirely, enabling complete system compromise for applications processing untrusted input. A patch is available in version 2.7.2.
Command injection in Deno versions prior to 2.6.8 allows unauthenticated remote attackers to execute arbitrary commands through the node:child_process implementation. Public exploit code exists for this vulnerability, which carries a CVSS score of 8.1 and affects the confidentiality, integrity, and availability of affected systems. Users should upgrade to Deno 2.6.8 or later to remediate this risk.
Arbitrary code execution in Deno runtime versions before 2.5.6 allows unauthenticated attackers to bypass shell script execution restrictions by using alternate casing in batch file extensions (e.g., .BAT, .Bat instead of .bat). The case-sensitive validation flaw enables attackers to spawn blocked Windows batch and command files, achieving remote code execution. Public exploit code exists and no patch is currently available for affected systems.
Deno versions up to 2.6.0 contains a vulnerability that allows attackers to have infinite encryptions (CVSS 7.5).
Command injection on Windows in the Deno JavaScript/TypeScript runtime (versions prior to 2.5.3 and 2.2.15) allows attacker-supplied arguments to be interpreted as shell commands when a program spawns a .bat or .cmd file as a child process. The weakness is unauthenticated from a network vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N) and scores 8.1, but exploitation is conditional: it requires a Windows host, a Deno program that launches a batch file via Deno.Command or node:child_process, attacker-controlled data flowing into that process's arguments, and the 'run' permission having been granted. Publicly available exploit code exists, including a proof of concept in the GitHub security advisory that spawns calc.exe via an '&' metacharacter, and EPSS sits at 2.08% (81st percentile); there is no confirmed active exploitation (not in CISA KEV).
File-metadata disclosure in the Deno runtime allows code running under the permission model to retrieve stats for files it is explicitly denied read access to: Deno.FsFile.prototype.stat and Deno.FsFile.prototype.statSync skip the --deny-read check when a file handle has been opened with write-only flags (read:false, write:true), leaking file type, size and timestamps even though the analogous Deno.stat/Deno.statSync correctly enforce allow-read. Affected are Deno releases before 2.5.3 on the 2.5.x line and before 2.2.15 on the 2.2.x line (local code execution with write permission, per the PR:L vector). Severity is genuinely low and the signals agree: CVSS 3.3, EPSS 0.19% (8th percentile), a publicly available proof-of-concept in the vendor advisory, and confirmed fixes shipped by the vendor in 2.5.3 and 2.2.15 - no active exploitation is indicated.
Deno 2.x runtimes prior to 2.5.3 and 2.2.15 fail to apply the write-permission check to Deno.FsFile.prototype.utime() and utimeSync(), so a script running with read-only file access under --deny-write=./ can still change a file's access (atime) and modification (mtime) timestamps. The attacker must already be executing JavaScript/TypeScript inside the Deno sandbox with read permission on the target file and must open it as a read-only file handle; no remote or unauthenticated path exists, and impact is limited to metadata (timestamps) with no content write, read, or deletion. Publicly available proof-of-concept code is included in the GitHub security advisory, but EPSS is very low (0.20%, 9th percentile) and there is no confirmed active exploitation (CISA KEV); this is a low-severity, local sandbox-hardening issue.
Deno versions 2.2.0 through 2.2.4 contain an authorization bypass vulnerability in SQLite database handling that allows attackers to circumvent read/write database permission checks via the SQL `ATTACH DATABASE` statement. An unauthenticated remote attacker can exploit this with no user interaction to gain unauthorized read and write access to protected databases, achieving high confidentiality and integrity impact. Patch is available in Deno 2.2.5.
A security vulnerability in Deno (CVSS 5.3). Risk factors: public PoC available. Vendor patch is available.
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.41.3 and prior to versions 2.1.13, 2.2.13, and 2.3.2, `deno run --allow-read --deny-read main.ts` results in allowed, even though 'deny' should be stronger. The result is the same with all global unary permissions given as `--allow-* --deny-*`. This only affects a nonsensical combination of flags, so there shouldn't be a real impact on the userbase. Users may upgrade to version 2.1.13, 2.2.13, or 2.3.2 to receive a patch.
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions 1.46.0 through 2.1.6 have an issue that affects AES-256-GCM and AES-128-GCM in Deno in which the authentication tag is not being validated. This means tampered ciphertexts or incorrect keys might not be detected, which breaks the guarantees expected from AES-GCM. Older versions of Deno correctly threw errors in such cases, as does Node.js. Without authentication tag verification, AES-GCM degrades to essentially CTR mode, removing integrity protection. Authenticated data set with set_aad is also affected, as it is incorporated into the GCM hash (ghash) but this too is not validated, rendering AAD checks ineffective. Version 2.1.7 includes a patch that addresses this issue.
An issue in `.npmrc` support in Deno 1.44.0 was discovered where Deno would send `.npmrc` credentials for the scope to the tarball URL when the registry provided URLs for a tarball on a different. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. Rated critical severity (CVSS 9.0), this vulnerability is low attack complexity. No vendor patch available.
Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. Public exploit code available.
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Deno is a runtime for JavaScript and TypeScript. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Deno is a simple, modern and secure runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket function, which contains regexes in the form of /s*,s*/, used for. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
Deno is a runtime for JavaScript and TypeScript. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Deno Standard Modules before 0.107.0 allows Code Injection via an untrusted YAML file in certain configurations. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Command injection in Deno 2.7.0 through 2.9.7 on Windows allows an attacker who controls arguments passed to node:child_process spawn/exec calls with the shell option enabled to execute arbitrary OS commands with the privileges of the Deno process. The root cause is that Deno applied cmd.exe quoting rules to every shell, so arguments escaped for cmd.exe are reinterpreted as syntax by PowerShell/pwsh, a custom bash.exe, or another POSIX-style shell running on Windows. Exploitation requires a specific, non-default developer-chosen pattern - untrusted arguments plus the shell option on a Windows host, which is why the assessed vector carries AC:H/AT:P - and no public exploit has been identified at time of analysis, although the vendor has published an upstream fix in PR 36772.
Deno versions 2.7.0 through 2.7.1 contain a command injection vulnerability in the node:child_process polyfill where improper quote handling allows attackers to bypass previous security fixes and execute arbitrary OS commands through shell metacharacter injection in spawn/spawnSync arguments. This vulnerability bypasses Deno's permission system entirely, enabling complete system compromise for applications processing untrusted input. A patch is available in version 2.7.2.
Command injection in Deno versions prior to 2.6.8 allows unauthenticated remote attackers to execute arbitrary commands through the node:child_process implementation. Public exploit code exists for this vulnerability, which carries a CVSS score of 8.1 and affects the confidentiality, integrity, and availability of affected systems. Users should upgrade to Deno 2.6.8 or later to remediate this risk.
Arbitrary code execution in Deno runtime versions before 2.5.6 allows unauthenticated attackers to bypass shell script execution restrictions by using alternate casing in batch file extensions (e.g., .BAT, .Bat instead of .bat). The case-sensitive validation flaw enables attackers to spawn blocked Windows batch and command files, achieving remote code execution. Public exploit code exists and no patch is currently available for affected systems.
Deno versions up to 2.6.0 contains a vulnerability that allows attackers to have infinite encryptions (CVSS 7.5).
Command injection on Windows in the Deno JavaScript/TypeScript runtime (versions prior to 2.5.3 and 2.2.15) allows attacker-supplied arguments to be interpreted as shell commands when a program spawns a .bat or .cmd file as a child process. The weakness is unauthenticated from a network vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N) and scores 8.1, but exploitation is conditional: it requires a Windows host, a Deno program that launches a batch file via Deno.Command or node:child_process, attacker-controlled data flowing into that process's arguments, and the 'run' permission having been granted. Publicly available exploit code exists, including a proof of concept in the GitHub security advisory that spawns calc.exe via an '&' metacharacter, and EPSS sits at 2.08% (81st percentile); there is no confirmed active exploitation (not in CISA KEV).
File-metadata disclosure in the Deno runtime allows code running under the permission model to retrieve stats for files it is explicitly denied read access to: Deno.FsFile.prototype.stat and Deno.FsFile.prototype.statSync skip the --deny-read check when a file handle has been opened with write-only flags (read:false, write:true), leaking file type, size and timestamps even though the analogous Deno.stat/Deno.statSync correctly enforce allow-read. Affected are Deno releases before 2.5.3 on the 2.5.x line and before 2.2.15 on the 2.2.x line (local code execution with write permission, per the PR:L vector). Severity is genuinely low and the signals agree: CVSS 3.3, EPSS 0.19% (8th percentile), a publicly available proof-of-concept in the vendor advisory, and confirmed fixes shipped by the vendor in 2.5.3 and 2.2.15 - no active exploitation is indicated.
Deno 2.x runtimes prior to 2.5.3 and 2.2.15 fail to apply the write-permission check to Deno.FsFile.prototype.utime() and utimeSync(), so a script running with read-only file access under --deny-write=./ can still change a file's access (atime) and modification (mtime) timestamps. The attacker must already be executing JavaScript/TypeScript inside the Deno sandbox with read permission on the target file and must open it as a read-only file handle; no remote or unauthenticated path exists, and impact is limited to metadata (timestamps) with no content write, read, or deletion. Publicly available proof-of-concept code is included in the GitHub security advisory, but EPSS is very low (0.20%, 9th percentile) and there is no confirmed active exploitation (CISA KEV); this is a low-severity, local sandbox-hardening issue.
Deno versions 2.2.0 through 2.2.4 contain an authorization bypass vulnerability in SQLite database handling that allows attackers to circumvent read/write database permission checks via the SQL `ATTACH DATABASE` statement. An unauthenticated remote attacker can exploit this with no user interaction to gain unauthorized read and write access to protected databases, achieving high confidentiality and integrity impact. Patch is available in Deno 2.2.5.
A security vulnerability in Deno (CVSS 5.3). Risk factors: public PoC available. Vendor patch is available.
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.41.3 and prior to versions 2.1.13, 2.2.13, and 2.3.2, `deno run --allow-read --deny-read main.ts` results in allowed, even though 'deny' should be stronger. The result is the same with all global unary permissions given as `--allow-* --deny-*`. This only affects a nonsensical combination of flags, so there shouldn't be a real impact on the userbase. Users may upgrade to version 2.1.13, 2.2.13, or 2.3.2 to receive a patch.
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions 1.46.0 through 2.1.6 have an issue that affects AES-256-GCM and AES-128-GCM in Deno in which the authentication tag is not being validated. This means tampered ciphertexts or incorrect keys might not be detected, which breaks the guarantees expected from AES-GCM. Older versions of Deno correctly threw errors in such cases, as does Node.js. Without authentication tag verification, AES-GCM degrades to essentially CTR mode, removing integrity protection. Authenticated data set with set_aad is also affected, as it is incorporated into the GCM hash (ghash) but this too is not validated, rendering AAD checks ineffective. Version 2.1.7 includes a patch that addresses this issue.
An issue in `.npmrc` support in Deno 1.44.0 was discovered where Deno would send `.npmrc` credentials for the scope to the tarball URL when the registry provided URLs for a tarball on a different. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. Rated critical severity (CVSS 9.0), this vulnerability is low attack complexity. No vendor patch available.
Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. Public exploit code available.
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Deno is a runtime for JavaScript and TypeScript. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Deno is a simple, modern and secure runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket function, which contains regexes in the form of /s*,s*/, used for. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
Deno is a runtime for JavaScript and TypeScript. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Deno Standard Modules before 0.107.0 allows Code Injection via an untrusted YAML file in certain configurations. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.