CVE Feed

    Dashboard / CVE / CVE-2023-28446

    CVE-2023-28446

    Deno is a simple, modern and secure runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Arbitrary program names without any ANSI filtering allows any malicious program to clear the first 2 lines of a `op_spawn_child` or `op_kill` prompt and replace it with any desired text. This works with any command on the respective platform, giving the program the full ability to choose what program they wanted to run. This problem can not be exploited on systems that do not attach an interactive prompt (for example headless servers). This issue has been patched in version 1.31.2.

    Published:Mar 24, 2023
    Last Modified:Feb 19, 2025
    EPS:Mar 24, 2023
    EPSS Score:0.0124
    CVSS Score:8.8

    Affected Products

    Vendor
    Deno
    Product
    Deno

    Exploits

    https://github.com/denoland/deno/security/advisories/GHSA-vq67-rp93-65qfhttps://github.com/denoland/deno/security/advisories/GHSA-vq67-rp93-65qf

    Related CVEs

    CVE-2026-55517 (CVSS 4.3) — Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.5, a Deno program that opens a client …
    CVE-2026-44726 (CVSS 7.4) — Deno is a JavaScript, TypeScript, and WebAssembly runtime. From 2.0.0 until 2.7.8, a flaw in Deno's Node.js tl…
    CVE-2026-49401 (CVSS 7.3) — Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.14, Deno's permission system enforces …
    CVE-2026-49402 (CVSS 8.1) — Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.10, Deno's node:child_process implemen…
    CVE-2026-49406 (CVSS 5.5) — Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.12, when Deno was run in BYONM mode (n…
    CVE-2026-49411 (CVSS 6.5) — Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.0, the Node.js compatibility TCP path …
    CVE-2026-49983 (CVSS 5.2) — Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, environment access is gated by the …
    CVE-2026-49860 (CVSS 5.2) — Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, when a WebSocket connection was ope…
    CVE-2026-49859 (CVSS 5.2) — Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, when fetch() was called, Deno check…
    CVE-2026-49440 (CVSS 7.4) — Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, node:crypto.checkPrime(candidate[, …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High