Security
فارسی
All products

deno

Rust / Cargo · Package
37 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Deno has --allow-read / --allow-write permission bypass in `node:sqlite`CVE-2025-48935 · GHSA-8VXJ-4CPH-C596Version ranges need review. denodeno_node Rust / Cargo Medium Fix reported
Deno run with --allow-read and --deny-read flags results in allowedCVE-2025-48888 · GHSA-XQXC-X6P3-W683 denodeno_runtime Rust / Cargo Medium Fix reported
Deno.env.toObject() ignores the variables listed in --deny-env and returns all environment variablesCVE-2025-48934 · GHSA-7W8P-CHXQ-2789 denodeno_runtime Rust / Cargo Medium Fix reported
Deno's AES GCM authentication tags are not verifiedCVE-2025-24015 · GHSA-2X3R-HWV5-P32X denodeno_node Rust / Cargo High Fix reported
Deno permission escalation vulnerability via open of privileged files with missing `--deny` flagCVE-2024-34346 · GHSA-23RX-C3G5-HV9W deno Rust / Cargo High Fix reported
Deno's deno_runtime vulnerable to interactive permission prompt spoofing via improper ANSI strippingCVE-2024-27936 · GHSA-M4PQ-FV2W-6HRW denodeno_runtime Rust / Cargo High Fix reported
Deno's Node.js Compatibility Runtime has Cross-Session Data ContaminationCVE-2024-27935 · GHSA-WRQV-PF6J-MQJP deno Rust / Cargo High Fix reported
Deno arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypassCVE-2024-27933 · GHSA-6Q4W-9X56-RMWQ deno Rust / Cargo High Fix reported
Deno's improper suffix match testing for DENO_AUTH_TOKENSCVE-2024-27932 · GHSA-5FRW-4RWQ-XHCR deno Rust / Cargo Medium Fix reported
Insufficient permission checking in `Deno.makeTemp*` APIsCVE-2024-27931 · GHSA-HRQR-JV8W-V9JH deno Rust / Cargo Medium Fix reported
Missing "--allow-net" permission check for built-in Node modulesCVE-2023-33966 · GHSA-VC52-GWM3-8V2F denodeno_runtime Rust / Cargo High Fix reported
Interactive `run` permission prompt spoofing via improper ANSI neutralizationCVE-2023-28446 · GHSA-VQ67-RP93-65QF denodeno_runtime Rust / Cargo High Fix reported
Deno is vulnerable to race condition via interactive permission prompt spoofingCVE-2023-22499 · GHSA-MC52-JPM2-CQH6 deno Rust / Cargo High Fix reported
Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypassCVE-2026-22864 · GHSA-M3C4-PRHW-MRX6 deno Rust / Cargo High Fix reported
Deno: Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)CVE-2026-49401 · GHSA-8XPQ-CJCF-3WH9 deno Rust / Cargo High Fix reported
Deno: Command Injection via spawnSync & spawn on WindowsCVE-2026-49402 · GHSA-7XH3-MHG9-JCW8 deno Rust / Cargo High Fix reported
Deno: `fetch()` API sandbox bypass via missing DNS resolution checkCVE-2026-49859 · GHSA-CPGJ-F7G3-2PP2 deno Rust / Cargo Medium Fix reported
Deno: WebSocket API sandbox bypass via missing post-DNS checkCVE-2026-49860 · GHSA-83PC-3RW9-QPWJ deno Rust / Cargo Medium Fix reported
Deno: process.loadEnvFile() bypasses env permission checks and mutates process.env with only read accessCVE-2026-49983 · GHSA-4C8G-JVCX-V4HV deno Rust / Cargo Medium Fix reported
Deno: Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checksCVE-2026-49411 · GHSA-V8FW-85R8-5M23 deno Rust / Cargo Medium Fix reported