denoland

Records44All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical12CVSS 9.0–10.0

CVSS high17CVSS 7.0–8.9

Exploited now

denoland records in CISA KEV

No denoland vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Deno 38 records HIGH Deno Runtime 3 records HIGH Deno Standard Modules 1 record MEDIUM Serde V8 1 record MEDIUM

Records

38 records in Deno · all components

TI-2026-21627 CVE-2026-27190 · GHSA-hmh4-3xvx-q5hr

Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process

HIGH 76

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0246 Published 2026-02-20 Fixed in 2.6.8 CWE-78

TI-2025-17782 CVE-2025-24015 · GHSA-2x3r-hwv5-p32x

Deno's AES GCM authentication tags are not verified

HIGH 73

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00287 Published 2025-06-03 Fixed in 2.1.7, 0.125.0 CWE-347

TI-2024-18537 CVE-2024-27934 · GHSA-3j27-563v-28wf

*const c_void / ExternalPointer unsoundness leading to use-after-free

HIGH 73

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 3.1HIGH 8.8 Local Low privileges No interaction EPSS 0.00392 Published 2024-03-06 Fixed in 1.40.3 CWE-416

TI-2024-18536 CVE-2024-27933 · GHSA-6q4w-9x56-rmwq

Deno arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypass

HIGH 73

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 3.1HIGH 8.8 Local Low privileges No interaction EPSS 0.02276 Published 2024-03-06 Fixed in 1.39.1 CWE-863

TI-2023-12990 CVE-2023-28446 · GHSA-vq67-rp93-65qf

Deno is vulnerable to interactive `run` permission prompt spoofing via improper ANSI neutralization

HIGH 73

Deno is a simple, modern and secure runtime for JavaScript and TypeScript that uses V8 and is built in Rust.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01132 Published 2023-03-24 Fixed in 1.31.2 CWE-150

TI-2023-11328 CVE-2023-26103 · GHSA-jc97-h3h9-7xh6

Regular expression denial of service in deno

HIGH 72

Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket function, which contains regexes in the form of /s*,s*/, used for splitting the Connec…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01229 Published 2023-02-25 Fixed in 1.31.0 CWE-1333

TI-2024-18539 CVE-2024-27936 · GHSA-m4pq-fv2w-6hrw

Deno interactive permission prompt spoofing via improper ANSI stripping

HIGH 71

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00943 Published 2024-03-06 Fixed in 1.41.0, 0.147.0 CWE-150

TI-2026-36567 CVE-2026-49402 · GHSA-7xh3-mhg9-jcw8

Deno: Command Injection via spawnSync & spawn on Windows

HIGH 70

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00445 Published 2026-06-23 Fixed in 2.7.10 CWE-78

TI-2025-38180 CVE-2025-61787 · GHSA-m2gf-x3f6-8hq3

Deno is Vulnerable to Command Injection on Windows During Batch File Execution

HIGH 70

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.02084 Published 2025-10-08 Fixed in 2.5.3, 2.2.15 +1 CWE-77

TI-2024-18538 CVE-2024-27935 · GHSA-wrqv-pf6j-mqjp

Deno's Node.js Compatibility Runtime has Cross-Session Data Contamination

HIGH 69

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 3.1HIGH 8.3 Network No auth No interaction EPSS 0.00722 Published 2024-03-06 Fixed in 1.36.3 CWE-488

TI-2023-08746 CVE-2023-22499 · GHSA-mc52-jpm2-cqh6

Interactive permission prompt spoofing in Deno

HIGH 68

Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.00618 Published 2023-01-17 Fixed in 1.29.3 CWE-362

TI-2024-21371 CVE-2024-32477

Race condition when flushing input stream leads to permission prompt bypass

HIGH 67

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults.

CVSS 3.1HIGH 7.7 Local No auth No interaction EPSS 0.0034 Published 2024-04-18 Fixed in 1.42.2 CWE-362

TI-2025-31072 CVE-2025-48934 · GHSA-7w8p-chxq-2789

Deno.env.toObject() ignores the variables listed in --deny-env and returns all environment variables

MEDIUM 64

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 4.0MEDIUM 5.5 Network No auth No interaction EPSS 0.00444 Published 2025-06-04 Fixed in 2.1.13, 2.2.13 +1 CWE-201

TI-2025-31038 CVE-2025-48888 · GHSA-xqxc-x6p3-w683

Deno run with --allow-read and --deny-read flags results in allowed

MEDIUM 64

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 4.0MEDIUM 5.5 Network No auth No interaction EPSS 0.00423 Published 2025-06-04 Fixed in 2.1.13, 2.2.13 +2 CWE-863

TI-2026-36569 CVE-2026-49411 · GHSA-v8fw-85r8-5m23

Deno Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks

MEDIUM 62

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 3.1MEDIUM 6.5 Local Low privileges No interaction EPSS 0.00158 Published 2026-06-23 Fixed in 2.8.0 CWE-284

TI-2026-36568 CVE-2026-49406 · GHSA-968w-xfqw-vp9q

Deno: BYONM module resolution allows `package.json` main path traversal to bypass `--allow-read` restrictions

MEDIUM 58

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00176 Published 2026-06-23 Fixed in 2.7.12 CWE-22

TI-2025-31073 CVE-2025-48935 · GHSA-8vxj-4cph-c596

Deno has --allow-read / --allow-write permission bypass in `node:sqlite`

MEDIUM 58

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 4.0MEDIUM 5.5 Network No auth No interaction EPSS 0.00488 Published 2025-06-04 Fixed in 2.2.5, 0.134.0 CWE-863

TI-2024-18535 CVE-2024-27932 · GHSA-5frw-4rwq-xhcr

Deno's improper suffix match testing for DENO_AUTH_TOKENS

MEDIUM 54

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00594 Published 2024-03-06 Fixed in 1.40.4 CWE-20

TI-2022-08596 CVE-2022-24783 · GHSA-838h-jqp6-cf2f

Sandbox bypass leading to arbitrary code execution in Deno

MEDIUM 51

Deno is a runtime for JavaScript and TypeScript.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01147 Published 2022-03-25 Fixed in 1.20.3 CWE-269

TI-2025-38178 CVE-2025-61785 · GHSA-vg2r-rmgp-cgqj

Deno's --deny-write check does not prevent permission bypass

MEDIUM 49

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 3.1LOW 3.3 Local Low privileges No interaction EPSS 0.00204 Published 2025-10-08 Fixed in 2.5.3, 2.2.15 CWE-266

TI-2023-16834 CVE-2023-33966 · GHSA-vc52-gwm3-8v2f

Deno missing "--allow-net" permission check for built-in Node modules

MEDIUM 49

Deno is a runtime for JavaScript and TypeScript.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00625 Published 2023-05-31 Fixed in 1.34.1, 0.115.0 CWE-269

TI-2026-24789 CVE-2026-32260 · GHSA-4c96-w8v2-p28j

Command Injection via incomplete shell metacharacter blocklist in node:child_process (bypass of CVE-2026-27190 fix)

MEDIUM 46

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01635 Published 2026-03-12 Fixed in 2.7.2 CWE-78

TI-2026-18355 CVE-2026-22863 · GHSA-5379-f5hf-w38v

Deno node:crypto doesn't finalize cipher

MEDIUM 45

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00204 Published 2026-01-15 Fixed in 2.6.0 CWE-325

TI-2023-12989 CVE-2023-28445 · GHSA-c25x-cm9x-qqgx

Deno improperly handles resizable ArrayBuffer

MEDIUM 45

Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.00971 Published 2023-03-23 Fixed in 1.32.1, 0.88.0 +1 CWE-125

TI-2026-18356 CVE-2026-22864 · GHSA-m3c4-prhw-mrx6

Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass

MEDIUM 44

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00672 Published 2026-01-15 Fixed in 2.5.6 CWE-77

Open these records in search →