Read the docs
TI-2024-22687 Aliases CVE-2024-34346GHSA-23rx-c3g5-hv9w

Deno contains a permission escalation via open of privileged files with missing `--deny` flag

Priority MEDIUM 41CWE-863Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. The Deno sandbox may be unexpectedly weakened by allowing file read/write access to privileged files in various locations on Unix and Windows platforms. For example, reading `/proc/self/environ` may provide access equivalent to `--allow-env`, and writing `/proc/self/mem` may provide access equivalent to `--allow-all`. Users who grant read and write access to the entire filesystem may not realize that these access to these files may have additional, unintended consequences. The documentation did not reflect that this practice should be undertaken to increase the strength of the security sandbox. Users who run code with `--allow-read` or `--allow-write` may unexpectedly end up granting additional permissions via file-system operations. Deno 1.43 and above require explicit `--allow-all` access to read or write `/etc`, `/dev` on unix platform (as well as `/proc` and `/sys` on linux platforms), and any path starting with `\\` on Windows.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00368 30th percentileScored 2026-11-07
Fix Fixed deno (denoland): 1.43.0deno (crates.io): 1.43.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
denolanddenobefore 1.43.01.43.0Patch availableCNA
—deno (crates.io)before 1.43.11.43.1Patch availableGHSA-23rx-c3g5-hv9w
  • deno Vendordenoland Affected before 1.43.0 Fixed in 1.43.0 Patch available CNA
  • deno (crates.io) Vendor— Affected before 1.43.1 Fixed in 1.43.1 Patch available GHSA-23rx-c3g5-hv9w

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:*before 1.43.1Vulnerabledenoland
  • cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:* Versions before 1.43.1 Vulnerable ·denoland

Remediation

  • Fix · CNA deno (denoland) Fixed in 1.43.0
  • Fix · GHSA-23rx-c3g5-hv9w deno (crates.io) Fixed in 1.43.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-34346
  2. 2026-10-03 Alias added: GHSA-23rx-c3g5-hv9w

References

Advisory 2

Other 1

  • TI-2026-21627 Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process CVSS 3.1CRITICAL 9.8
  • TI-2025-17782 Deno's AES GCM authentication tags are not verified CVSS 4.0HIGH 7.7
  • TI-2024-18537 *const c_void / ExternalPointer unsoundness leading to use-after-free CVSS 3.1HIGH 8.8
  • TI-2024-18536 Deno arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypass CVSS 3.1HIGH 8.8
  • TI-2023-12990 Deno is vulnerable to interactive `run` permission prompt spoofing via improper ANSI neutralization CVSS 3.1HIGH 8.8
  • TI-2023-11328 Regular expression denial of service in deno CVSS 3.1HIGH 7.5
See all 37 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences