deno vulnerabilities (crates.io)
37 vulnerabilities.
-
denocrates.io Deno: Denial of service via non-ASCII bytes in WebSocket response headers 4.3 Medium -
denocrates.io Deno Permission Bypass via Unicode Normalization Mismatch on macOS (APFS) 7.3 High -
denocrates.io Deno: BYONM module resolution allows `package.json` main path traversal to bypass `--allow-read` restrictions 5.5 Medium -
denocrates.io Deno Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks 6.5 Medium -
denocrates.io Deno: Miller-Rabin Primality Test Allows Zero Rounds 7.4 High -
denocrates.io Deno: Command Injection via spawnSync & spawn on Windows 8.1 High -
denocrates.io Deno: process.loadEnvFile() bypasses env permission checks and mutates process.env with only read access 5.2 Medium -
denocrates.io Deno: WebSocket API sandbox bypass via missing post-DNS check 5.2 Medium -
denocrates.io Deno: `fetch()` API sandbox bypass via missing DNS resolution check 5.2 Medium -
denocrates.io Deno: TLS retry copies stale upgrade hook, risking plaintext traffic 7.4 High -
denocrates.io Command Injection via incomplete shell metacharacter blocklist in node:child_process (bypass of CVE-2026-27190 fix) 8.1 High -
denocrates.io Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process 8.1 High -
denocrates.io Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass 8.1 High -
denocrates.io Deno node:crypto doesn't finalize cipher 9.2 Critical -
denocrates.io Deno is Vulnerable to Command Injection on Windows During Batch File Execution 8.1 High -
denocrates.io Deno's --deny-read check does not prevent permission bypass 3.3 Low -
denocrates.io Deno's --deny-write check does not prevent permission bypass 3.3 Low -
denocrates.io Deno vulnerable to Exposure of Sensitive Information to an Unauthorized Actor 5.3 Medium -
denocrates.io Deno.env.toObject() ignores the variables listed in --deny-env and returns all environment variables 5.5 Medium -
denocrates.io Deno run with --allow-read and --deny-read flags results in allowed 5.5 Medium -
denocrates.io Deno's AES GCM authentication tags are not verified 7.7 High -
denocrates.io Deno has --allow-read / --allow-write permission bypass in `node:sqlite` 5.5 Medium -
denocrates.io Deno's authorization headers not dropped when redirecting cross-origin 7.5 High -
denocrates.io Deno contains a permission escalation via open of privileged files with missing `--deny` flag 8.5 High -
denocrates.io *const c_void / ExternalPointer unsoundness leading to use-after-free 8.4 High -
denocrates.io Deno arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypass 8.3 High -
denocrates.io Deno's improper suffix match testing for DENO_AUTH_TOKENS 4.6 Medium -
denocrates.io Deno interactive permission prompt spoofing via improper ANSI stripping 8.8 High -
denocrates.io Deno's Node.js Compatibility Runtime has Cross-Session Data Contamination 7.2 High -
denocrates.io Insufficient permission checking in `Deno.makeTemp*` APIs 5.8 Medium -
denocrates.io Deno missing "--allow-net" permission check for built-in Node modules 8.6 High -
denocrates.io Deno is vulnerable to interactive `run` permission prompt spoofing via improper ANSI neutralization 8.8 High -
denocrates.io Regular Expression Denial of Service in Deno.upgradeWebSocket API 5.3 Medium -
denocrates.io Interactive permission prompt spoofing in Deno 7.5 High -
denocrates.io Link Following in Deno 8.4 High -
denocrates.io Sandbox bypass leading to arbitrary code execution in Deno 10.0 Critical -
denocrates.io Static imports inside dynamically imported modules do not adhere to permission checks 9.8 Critical