TI-2024-18539 Aliases CVE-2024-27936 GHSA-m4pq-fv2w-6hrw

Deno interactive permission prompt spoofing via improper ANSI stripping

HIGH 71CWE-150Published 2024-03-06 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. Starting in version 1.32.1 and prior to version 1.41.0 of the deno library, maliciously crafted permission request can show the spoofed permission prompt by inserting a broken ANSI escape sequence into the request contents. Deno is stripping any ANSI escape sequences from the permission prompt, but permissions given to the program are based on the contents that contain the ANSI escape sequences. Any Deno program can spoof the content of the interactive permission prompt by inserting a broken ANSI code, which allows a malicious Deno program to display the wrong file path or program name to the user. Version 1.41.0 of the deno library contains a patch for the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00943 61st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed deno (denoland): 1.41.0deno (crates.io): 1.41.0+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
denoland	deno	1.32.1 to before 1.41.0	1.41.0	Patch available	CNA
—	deno (crates.io)	1.32.1 to before 1.41.0	1.41.0	Patch available	GHSA-m4pq-fv2w-6hrw
—	deno_runtime (crates.io)	0.103.0 to before 0.147.0	0.147.0	Patch available	GHSA-m4pq-fv2w-6hrw

deno Vendordenoland Affected 1.32.1 to before 1.41.0 Fixed in 1.41.0 Patch available CNA
deno (crates.io) Vendor— Affected 1.32.1 to before 1.41.0 Fixed in 1.41.0 Patch available GHSA-m4pq-fv2w-6hrw
deno_runtime (crates.io) Vendor— Affected 0.103.0 to before 0.147.0 Fixed in 0.147.0 Patch available GHSA-m4pq-fv2w-6hrw

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:deno:deno::::::::	1.32.1 to before 1.41.0	Vulnerable	denoland
cpe:2.3:a:deno:deno_runtime::::::rust::*	0.103.0 to before 0.147.0	Vulnerable	denoland

cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:* Versions 1.32.1 to before 1.41.0 Vulnerable ·denoland
cpe:2.3:a:deno:deno_runtime:*:*:*:*:*:rust:*:* Versions 0.103.0 to before 0.147.0 Vulnerable ·denoland

Remediation

Fix · CNA deno (denoland) Fixed in 1.41.0
Fix · GHSA-m4pq-fv2w-6hrw deno (crates.io) Fixed in 1.41.0 Advisory →
Fix · GHSA-m4pq-fv2w-6hrw deno_runtime (crates.io) Fixed in 0.147.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-27936
2026-10-03 Alias added: GHSA-m4pq-fv2w-6hrw

References

Exploit 1

https://github.com/denoland/deno/security/advisories/GHSA-m4pq-fv2w-6hrw

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2024-27936

Other 1

https://github.com/denoland/deno

TI-2026-21627 Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process CVSS 3.1CRITICAL 9.8
TI-2025-17782 Deno's AES GCM authentication tags are not verified CVSS 4.0HIGH 7.7
TI-2024-18537 *const c_void / ExternalPointer unsoundness leading to use-after-free CVSS 3.1HIGH 8.8
TI-2024-18536 Deno arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypass CVSS 3.1HIGH 8.8
TI-2023-12990 Deno is vulnerable to interactive `run` permission prompt spoofing via improper ANSI neutralization CVSS 3.1HIGH 8.8
TI-2023-11328 Regular expression denial of service in deno CVSS 3.1HIGH 7.5

See all 37 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences