CVE Feed

    Dashboard / CVE / CVE-2024-27936

    CVE-2024-27936

    Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. Starting in version 1.32.1 and prior to version 1.41.0 of the deno library, maliciously crafted permission request can show the spoofed permission prompt by inserting a broken ANSI escape sequence into the request contents. Deno is stripping any ANSI escape sequences from the permission prompt, but permissions given to the program are based on the contents that contain the ANSI escape sequences. Any Deno program can spoof the content of the interactive permission prompt by inserting a broken ANSI code, which allows a malicious Deno program to display the wrong file path or program name to the user. Version 1.41.0 of the deno library contains a patch for the issue.

    Published:Mar 6, 2024
    Last Modified:Jan 3, 2025
    EPS:Mar 6, 2024
    EPSS Score:0.0052
    CVSS Score:8.8

    Affected Products

    Vendor
    Deno
    Product
    Deno
    Vendor
    Deno
    Product
    Deno Runtime

    Exploits

    https://github.com/denoland/deno/security/advisories/GHSA-m4pq-fv2w-6hrwhttps://github.com/denoland/deno/security/advisories/GHSA-m4pq-fv2w-6hrw

    Related CVEs

    CVE-2026-55517 (CVSS 4.3) — Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.5, a Deno program that opens a client …
    CVE-2026-44726 (CVSS 7.4) — Deno is a JavaScript, TypeScript, and WebAssembly runtime. From 2.0.0 until 2.7.8, a flaw in Deno's Node.js tl…
    CVE-2026-49401 (CVSS 7.3) — Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.14, Deno's permission system enforces …
    CVE-2026-49402 (CVSS 8.1) — Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.10, Deno's node:child_process implemen…
    CVE-2026-49406 (CVSS 5.5) — Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.12, when Deno was run in BYONM mode (n…
    CVE-2026-49411 (CVSS 6.5) — Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.0, the Node.js compatibility TCP path …
    CVE-2026-49983 (CVSS 5.2) — Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, environment access is gated by the …
    CVE-2026-49860 (CVSS 5.2) — Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, when a WebSocket connection was ope…
    CVE-2026-49859 (CVSS 5.2) — Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, when fetch() was called, Deno check…
    CVE-2026-49440 (CVSS 7.4) — Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, node:crypto.checkPrime(candidate[, …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High