Read the docs
TI-2022-08596 Aliases CVE-2022-24783GHSA-838h-jqp6-cf2f

Sandbox bypass leading to arbitrary code execution in Deno

Priority MEDIUM 51CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation, Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-269 and CWE-863.

Summary

Deno is a runtime for JavaScript and TypeScript. The versions of Deno between release 1.18.0 and 1.20.2 (inclusive) are vulnerable to an attack where a malicious actor controlling the code executed in a Deno runtime could bypass all permission checks and execute arbitrary shell code. This vulnerability does not affect users of Deno Deploy. The vulnerability has been patched in Deno 1.20.3. There is no workaround. All users are recommended to upgrade to 1.20.3 immediately.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01147 66th percentileScored 2026-11-07
Fix Fixed deno (denoland): 1.20.3deno (crates.io): 1.20.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
denolanddeno1.18.0 to before 1.20.31.20.3Patch availableCNA
—deno (crates.io)1.18.0 to before 1.20.31.20.3Patch availableGHSA-838h-jqp6-cf2f
  • deno Vendordenoland Affected 1.18.0 to before 1.20.3 Fixed in 1.20.3 Patch available CNA
  • deno (crates.io) Vendor— Affected 1.18.0 to before 1.20.3 Fixed in 1.20.3 Patch available GHSA-838h-jqp6-cf2f

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:*1.18.0 to before 1.20.3Vulnerabledenoland
  • cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:* Versions 1.18.0 to before 1.20.3 Vulnerable ·denoland

Remediation

  • Fix · CNA deno (denoland) Fixed in 1.20.3
  • Fix · GHSA-838h-jqp6-cf2f deno (crates.io) Fixed in 1.20.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-24783
  2. 2026-10-03 Alias added: GHSA-838h-jqp6-cf2f

References

Advisory 2

Other 5

  • TI-2026-21627 Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process CVSS 3.1CRITICAL 9.8
  • TI-2025-17782 Deno's AES GCM authentication tags are not verified CVSS 4.0HIGH 7.7
  • TI-2024-18537 *const c_void / ExternalPointer unsoundness leading to use-after-free CVSS 3.1HIGH 8.8
  • TI-2024-18536 Deno arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypass CVSS 3.1HIGH 8.8
  • TI-2023-12990 Deno is vulnerable to interactive `run` permission prompt spoofing via improper ANSI neutralization CVSS 3.1HIGH 8.8
  • TI-2023-11328 Regular expression denial of service in deno CVSS 3.1HIGH 7.5
See all 37 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences