Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
6 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The Deno.env.toObject method ignores any variables listed in the --deny-env option of the deno run command. When looking at the documentation of the --deny-env option this might lead to a false impression that variables listed in the option are impossible to read. PoC The first example using get exits with the following error: The second example using toObject prints all environment variables: Impact Software relying on the combination of both flags to allow access to most environment variables except a few sensitive ones will be vulnerable to malicious code trying to steal secrets using the Deno.env.toObject() method.
Recommended action: Upgrade to 0.212.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
deno run --allow-read --deny-read main.ts results in allowed, even though 'deny' should be stronger. Same with all global unary permissions given as --allow- --deny-. Details Caused by the fast exit logic in #22894. PoC Run the above command expecting no permissions to be passed. Impact This only affects a nonsensical combination of flags, so there shouldn't be a real impact on the userbase.
Recommended action: Upgrade to 0.212.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A maliciously crafted permission request can show the spoofed permission prompt by inserting a broken ANSI escape sequence into the request contents. Details In the patch for CVE-2023-28446, Deno is stripping any ANSI escape sequences from the permission prompt, but permissions given to the program are based on the contents that contain the ANSI escape sequences. For example, requesting the read permission with /tmp/hello\u001b/../../etc/hosts as a path will display the /tmp/hellotc/hosts in the permission prompt, but the actual permission given to the program is /tmp/hello\u001b[/../../etc/hosts, which is /etc/hosts after the normalization. This difference allows a malicious Deno program to spoof the contents of the permission prompt. PoC Run the following JavaScript and observe that /tmp/hellotc/hosts is displayed in the permission prompt instead of /etc/hosts, although Deno gives access to /etc/hosts. Expected prompt Actual prompt Impact Any Deno program can spoof the…
Recommended action: Upgrade to 0.147.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Outbound HTTP requests made using the built-in "node:http" or "node:https" modules are incorrectly not checked against the network permission allow list (--allow-net). Dependencies relying on these built-in modules are subject to the vulnerability too. Users of Deno versions prior to 1.34.0 are unaffected. Deno Deploy users are unaffected. Patches This problem has been patched in Deno v1.34.1 and all users are recommended to update to this version. Workarounds No workaround is available for this issue.
Recommended action: Upgrade to 0.115.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Arbitrary program names without any ANSI filtering allows any malicious program to clear the first 2 lines of a opspawnchild or opkill prompt and replace it with any desired text. Details The main entry point comes down to the ability to override what the API control says (40process.js). Because of ANSI code's ability to clear lines, a malicious program can clear the last 2 lines of the prompt and put their own header. This also works in opkill. PoC This PoC works on 1.31.1, but modified versions of it work on older versions. Make a file, e.g. index.ts, that uses this vulnerability to spoof the opspawnchild permission prompt Run the file with deno run index.ts. Impact Any Deno program is able to spoof the interactive permission prompt for the opspawnchild or the opkill action (which indirectly gives access to all run commands) by overriding the Requested by {message} API with their own ANSI codes, allowing them to clear the latter prompt and change it to whatever they needed:…
Recommended action: Upgrade to 1.31.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Resizable ArrayBuffers passed to asynchronous native functions that are shrunk during the asynchronous operation could result in an out-of-bound read/write. It is unlikely that this has been exploited in the wild, as the only version affected is Deno 1.32.0. Deno Deploy users are not affected. Patches The problem has been resolved by disabling resizable ArrayBuffers temporarily in Deno 1.32.1. A future version of Deno will re-enable resizable ArrayBuffers with a proper fix. Workarounds Upgrade to Deno 1.32.1, or run with --v8-flags=--no-harmony-rab-gsab to disable resizable ArrayBuffers.
Recommended action: Upgrade to 0.103.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.