TI-2023-16834 Aliases CVE-2023-33966 GHSA-vc52-gwm3-8v2f

Deno missing "--allow-net" permission check for built-in Node modules

MEDIUM 49CWE-269Published 2023-05-31 · Updated 2025-01-09

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Privilege escalation
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-269.

Summary

Deno is a runtime for JavaScript and TypeScript. In deno 1.34.0 and deno_runtime 0.114.0, outbound HTTP requests made using the built-in `node:http` or `node:https` modules are incorrectly not checked against the network permission allow list (`--allow-net`). Dependencies relying on these built-in modules are subject to the vulnerability too. Users of Deno versions prior to 1.34.0 are unaffected. Deno Deploy users are unaffected. This problem has been patched in Deno v1.34.1 and deno_runtime 0.114.1 and all users are recommended to update to this version. No workaround is available for this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00625 50th percentileScored 2026-11-07

Fix Fixed deno (crates.io): 1.34.1deno_runtime (crates.io): 0.115.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
denoland	deno	deno = 1.34.0; deno_runtime = 0.114.0	—	No fix listed	CNA
—	deno (crates.io)	1.34.0 to before 1.34.1	1.34.1	Patch available	GHSA-vc52-gwm3-8v2f
—	deno_runtime (crates.io)	0.114.0 to before 0.115.0	0.115.0	Patch available	GHSA-vc52-gwm3-8v2f

deno Vendordenoland Affected deno = 1.34.0; deno_runtime = 0.114.0 Fixed in — No fix listed CNA
deno (crates.io) Vendor— Affected 1.34.0 to before 1.34.1 Fixed in 1.34.1 Patch available GHSA-vc52-gwm3-8v2f
deno_runtime (crates.io) Vendor— Affected 0.114.0 to before 0.115.0 Fixed in 0.115.0 Patch available GHSA-vc52-gwm3-8v2f

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:deno:deno:1.34.0:::::::*	1.34.0	Vulnerable	denoland
cpe:2.3:a:deno:deno_runtime:0.114.0:::::rust::	0.114.0	Vulnerable	denoland

cpe:2.3:a:deno:deno:1.34.0:*:*:*:*:*:*:* Versions 1.34.0 Vulnerable ·denoland
cpe:2.3:a:deno:deno_runtime:0.114.0:*:*:*:*:rust:*:* Versions 0.114.0 Vulnerable ·denoland

Remediation

Fix · GHSA-vc52-gwm3-8v2f deno (crates.io) Fixed in 1.34.1 Advisory →
Fix · GHSA-vc52-gwm3-8v2f deno_runtime (crates.io) Fixed in 0.115.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-33966
2026-10-03 Alias added: GHSA-vc52-gwm3-8v2f
2026-11-03 EPSS moved to the 50th–90th percentile

References

Advisory 2

Other 2

TI-2026-21627 Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process CVSS 3.1CRITICAL 9.8
TI-2025-17782 Deno's AES GCM authentication tags are not verified CVSS 4.0HIGH 7.7
TI-2024-18537 *const c_void / ExternalPointer unsoundness leading to use-after-free CVSS 3.1HIGH 8.8
TI-2024-18536 Deno arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypass CVSS 3.1HIGH 8.8
TI-2023-12990 Deno is vulnerable to interactive `run` permission prompt spoofing via improper ANSI neutralization CVSS 3.1HIGH 8.8
TI-2023-11328 Regular expression denial of service in deno CVSS 3.1HIGH 7.5

See all 37 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences