Improper neutralization of input during web page generation ("Cross-site Scripting") in deno_doc HTML generator
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
Deno is a runtime for JavaScript and TypeScript written in rust. Several cross-site scripting vulnerabilities existed in the `deno_doc` crate which lead to Self-XSS with deno doc --html. 1.) XSS in generated `search_index.js`, `deno_doc` outputs a JavaScript file for searching. However, the generated file used `innerHTML` on unsanitzed HTML input. 2.) XSS via property, method and enum names, `deno_doc` did not sanitize property names, method names and enum names. The first XSS most likely didn't have an impact since `deno doc --html` is expected to be used locally with own packages.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| denoland | deno | deno_doc: < 0.119.0; deno: < 1.42.0 | — | No fix listed | CNA |
| — | deno_doc (crates.io) | before 0.119.0 | 0.119.0 | Patch available | GHSA-qqwr-j9mm-fhw6 |
- deno Vendordenoland Affected deno_doc: < 0.119.0; deno: < 1.42.0 Fixed in — No fix listed CNA
- deno_doc (crates.io) Vendor— Affected before 0.119.0 Fixed in 0.119.0 Patch available GHSA-qqwr-j9mm-fhw6
Remediation
- Fix · GHSA-qqwr-j9mm-fhw6 deno_doc (crates.io) Fixed in 0.119.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-32468
- 2026-10-03 Alias added: GHSA-qqwr-j9mm-fhw6
References
Other 4
- https://github.com/denoland/deno/security/advisories/GHSA-qqwr-j9mm-fhw6
- https://github.com/denoland/deno_doc/blob/dc556c848831d7ae48f3eff2ababc6e75eb6b73e/src/html/templates/pages/search.js#L120-L144
- https://github.com/denoland/deno_doc/commit/0f1ef3efbf16194730a29d93dcb9c02f6c490942
- https://github.com/denoland/deno
More denoland vulnerabilities
- TI-2026-21627 Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process CVSS 3.1CRITICAL 9.8
- TI-2025-17782 Deno's AES GCM authentication tags are not verified CVSS 4.0HIGH 7.7
- TI-2024-18537 *const c_void / ExternalPointer unsoundness leading to use-after-free CVSS 3.1HIGH 8.8
- TI-2024-18536 Deno arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypass CVSS 3.1HIGH 8.8
- TI-2023-12990 Deno is vulnerable to interactive `run` permission prompt spoofing via improper ANSI neutralization CVSS 3.1HIGH 8.8
- TI-2023-11328 Regular expression denial of service in deno CVSS 3.1HIGH 7.5
Sources
- CVE-2024-32468 · CVE Program
- CVE-2024-32468 · NVD
- FIRST EPSS
- GHSA-qqwr-j9mm-fhw6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences