Vulnerabilities

TI-2026-65702 CVE-2026-103473 · GHSA-m6mv-f8h2-2w86

Deno 2.7.0 through 2.9.7 Command Injection via node:child_process

MEDIUM 45

Deno versions 2.7.0 through 2.9.7 on Windows contain a command injection vulnerability in node:child_process where shell arguments are escaped for the wrong shell type.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.01471 Published 2026-09-30 No fix listed CWE-78

TI-2026-40063 CVE-2026-55517 · GHSA-x2qc-cmh9-f4hf

Deno: Denial of service via non-ASCII bytes in WebSocket response headers

LOW 20

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00315 Published 2026-06-23 Fixed in 2.7.5 CWE-248

TI-2026-32613 CVE-2026-44726 · GHSA-chqv-56wv-7564

Deno: TLS retry copies stale upgrade hook, risking plaintext traffic

MEDIUM 41

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00234 Published 2026-06-23 Fixed in 2.7.8 CWE-319

TI-2026-36566 CVE-2026-49401 · GHSA-8xpq-cjcf-3wh9

Deno Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)

LOW 36

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 3.1HIGH 8.4 Local Low privileges No interaction EPSS 0.00197 Published 2026-06-23 Fixed in 2.7.14 CWE-176

TI-2026-36567 CVE-2026-49402 · GHSA-7xh3-mhg9-jcw8

Deno: Command Injection via spawnSync & spawn on Windows

HIGH 70

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00445 Published 2026-06-23 Fixed in 2.7.10 CWE-78

TI-2026-36568 CVE-2026-49406 · GHSA-968w-xfqw-vp9q

Deno: BYONM module resolution allows `package.json` main path traversal to bypass `--allow-read` restrictions

MEDIUM 58

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00176 Published 2026-06-23 Fixed in 2.7.12 CWE-22

TI-2026-36569 CVE-2026-49411 · GHSA-v8fw-85r8-5m23

Deno Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks

MEDIUM 62

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 3.1MEDIUM 6.5 Local Low privileges No interaction EPSS 0.00158 Published 2026-06-23 Fixed in 2.8.0 CWE-284

TI-2026-36816 CVE-2026-49983 · GHSA-4c8g-jvcx-v4hv

Deno: process.loadEnvFile() bypasses env permission checks and mutates process.env with only read access

LOW 23

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 3.1MEDIUM 5.2 Local Low privileges No interaction EPSS 0.0014 Published 2026-06-23 Fixed in 2.8.1 CWE-863

TI-2026-36764 CVE-2026-49860 · GHSA-83pc-3rw9-qpwj

Deno: WebSocket API sandbox bypass via missing post-DNS check

LOW 23

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 3.1MEDIUM 5.2 Local Low privileges No interaction EPSS 0.00141 Published 2026-06-23 Fixed in 2.8.1 CWE-918

TI-2026-36763 CVE-2026-49859 · GHSA-cpgj-f7g3-2pp2

Deno: `fetch()` API sandbox bypass via missing DNS resolution check

LOW 23

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 3.1MEDIUM 5.2 Local Low privileges No interaction EPSS 0.00141 Published 2026-06-23 Fixed in 2.8.1 CWE-693

TI-2026-36596 CVE-2026-49440 · GHSA-9xg4-qhm4-g43w

Deno: Miller-Rabin Primality Test Allows Zero Rounds

LOW 34

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00237 Published 2026-06-23 Fixed in 2.8.1 CWE-325

TI-2026-24789 CVE-2026-32260 · GHSA-4c96-w8v2-p28j

Command Injection via incomplete shell metacharacter blocklist in node:child_process (bypass of CVE-2026-27190 fix)

MEDIUM 46

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01635 Published 2026-03-12 Fixed in 2.7.2 CWE-78

TI-2026-21627 CVE-2026-27190 · GHSA-hmh4-3xvx-q5hr

Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process

HIGH 76

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0246 Published 2026-02-20 Fixed in 2.6.8 CWE-78

TI-2026-18356 CVE-2026-22864 · GHSA-m3c4-prhw-mrx6

Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass

MEDIUM 44

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00672 Published 2026-01-15 Fixed in 2.5.6 CWE-77

TI-2026-18355 CVE-2026-22863 · GHSA-5379-f5hf-w38v

Deno node:crypto doesn't finalize cipher

MEDIUM 45

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00204 Published 2026-01-15 Fixed in 2.6.0 CWE-325

TI-2025-38180 CVE-2025-61787 · GHSA-m2gf-x3f6-8hq3

Deno is Vulnerable to Command Injection on Windows During Batch File Execution

HIGH 70

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.02084 Published 2025-10-08 Fixed in 2.5.3, 2.2.15 +1 CWE-77

TI-2025-38179 CVE-2025-61786 · GHSA-qq26-84mh-26j9

Deno's --deny-read check does not prevent permission bypass

LOW 15

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 3.1LOW 3.3 Local Low privileges No interaction EPSS 0.002 Published 2025-10-08 Fixed in 2.5.3, 2.2.15 CWE-269

TI-2025-38178 CVE-2025-61785 · GHSA-vg2r-rmgp-cgqj

Deno's --deny-write check does not prevent permission bypass

MEDIUM 49

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 3.1LOW 3.3 Local Low privileges No interaction EPSS 0.00204 Published 2025-10-08 Fixed in 2.5.3, 2.2.15 CWE-266

TI-2025-34871 CVE-2025-55195

@std/toml Prototype Pollution in Node.js and Browser

HIGH 71

@std/toml is the Deno Standard Library.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00364 Published 2025-08-14 Fixed in 1.0.9 CWE-1321

TI-2025-31073 CVE-2025-48935 · GHSA-8vxj-4cph-c596

Deno has --allow-read / --allow-write permission bypass in `node:sqlite`

MEDIUM 58

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 4.0MEDIUM 5.5 Network No auth No interaction EPSS 0.00488 Published 2025-06-04 Fixed in 2.2.5, 0.134.0 CWE-863

TI-2025-31072 CVE-2025-48934 · GHSA-7w8p-chxq-2789

Deno.env.toObject() ignores the variables listed in --deny-env and returns all environment variables

MEDIUM 64

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 4.0MEDIUM 5.5 Network No auth No interaction EPSS 0.00444 Published 2025-06-04 Fixed in 2.1.13, 2.2.13 +1 CWE-201

TI-2025-31038 CVE-2025-48888 · GHSA-xqxc-x6p3-w683

Deno run with --allow-read and --deny-read flags results in allowed

MEDIUM 64

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 4.0MEDIUM 5.5 Network No auth No interaction EPSS 0.00423 Published 2025-06-04 Fixed in 2.1.13, 2.2.13 +2 CWE-863

TI-2025-17782 CVE-2025-24015 · GHSA-2x3r-hwv5-p32x

Deno's AES GCM authentication tags are not verified

HIGH 73

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00287 Published 2025-06-03 Fixed in 2.1.7, 0.125.0 CWE-347

TI-2025-15580 CVE-2025-21620 · GHSA-f27p-cmv8-xhm6

Deno's authorization headers not dropped when redirecting cross-origin

HIGH 66

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00522 Published 2025-01-06 Fixed in 2.1.2, 0.204.0 CWE-200

TI-2024-21363 CVE-2024-32468 · GHSA-qqwr-j9mm-fhw6

Improper neutralization of input during web page generation ("Cross-site Scripting") in deno_doc HTML generator

LOW 24

Deno is a runtime for JavaScript and TypeScript written in rust.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00354 Published 2024-11-25 Fixed in 0.119.0 CWE-79

Vulnerabilities

Filters