Read the docs
TI-2021-12288 Aliases CVE-2021-32619GHSA-xpwj-7v8q-mcgj

Static imports inside dynamically imported modules do not adhere to permission checks

Priority MEDIUM 44CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-285.

Summary

Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. In Deno versions 1.5.0 to 1.10.1, modules that are dynamically imported through `import()` or `new Worker` might have been able to bypass network and file system permission checks when statically importing other modules. The vulnerability has been patched in Deno release 1.10.2.

Why it matters now

EPSS 0.01113 66th percentileScored 2026-11-07
Fix Fixed deno (denoland): 1.10.2deno (crates.io): 1.10.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
denolanddenobefore 1.10.21.10.2Patch availableCNA
—deno (crates.io)1.5.0 to before 1.10.21.10.2Patch availableGHSA-xpwj-7v8q-mcgj
  • deno Vendordenoland Affected before 1.10.2 Fixed in 1.10.2 Patch available CNA
  • deno (crates.io) Vendor— Affected 1.5.0 to before 1.10.2 Fixed in 1.10.2 Patch available GHSA-xpwj-7v8q-mcgj

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:*1.5.0 to before 1.10.2Vulnerabledenoland
  • cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:* Versions 1.5.0 to before 1.10.2 Vulnerable ·denoland

Remediation

  • Fix · CNA deno (denoland) Fixed in 1.10.2
  • Fix · GHSA-xpwj-7v8q-mcgj deno (crates.io) Fixed in 1.10.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-32619
  2. 2026-10-03 Alias added: GHSA-xpwj-7v8q-mcgj

References

Advisory 2

Other 1

  • TI-2026-21627 Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process CVSS 3.1CRITICAL 9.8
  • TI-2025-17782 Deno's AES GCM authentication tags are not verified CVSS 4.0HIGH 7.7
  • TI-2024-18537 *const c_void / ExternalPointer unsoundness leading to use-after-free CVSS 3.1HIGH 8.8
  • TI-2024-18536 Deno arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypass CVSS 3.1HIGH 8.8
  • TI-2023-12990 Deno is vulnerable to interactive `run` permission prompt spoofing via improper ANSI neutralization CVSS 3.1HIGH 8.8
  • TI-2023-11328 Regular expression denial of service in deno CVSS 3.1HIGH 7.5
See all 37 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences