crates.io/deno

Deno permission escalation vulnerability via open of privileged files with missing `--deny` flag

Modified: 9/10/2026

Deno's AES GCM authentication tags are not verified

Modified: 9/10/2026

*const c_void / ExternalPointer unsoundness leading to use-after-free

Modified: 2/17/2026

Deno: process.loadEnvFile() bypasses env permission checks and mutates process.env with only read access

Modified: 7/20/2026

Deno vulnerable to command Injection via incomplete shell metacharacter blocklist in node:child_process

Modified: 3/14/2026

Deno node:crypto doesn't finalize cipher

Modified: 2/3/2026

Deno's improper suffix match testing for DENO_AUTH_TOKENS

Modified: 9/10/2026

Link Following in Deno

Modified: 11/8/2023

Deno arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypass

Modified: 9/10/2026

Deno.env.toObject() ignores the variables listed in --deny-env and returns all environment variables

Modified: 9/10/2026

Deno: Command Injection via spawnSync & spawn on Windows

Modified: 7/20/2026

Sandbox bypass leading to arbitrary code execution in Deno

Modified: 11/8/2023

Deno: WebSocket API sandbox bypass via missing post-DNS check

Modified: 7/20/2026

Deno has --allow-read / --allow-write permission bypass in `node:sqlite`

Modified: 2/3/2026

Deno: Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)

Modified: 7/31/2026

Deno: BYONM module resolution allows `package.json` main path traversal to bypass `--allow-read` restrictions

Modified: 7/20/2026

Deno: Miller-Rabin Primality Test Allows Zero Rounds

Modified: 6/16/2026

Deno's TLS retry copies stale upgrade hook, risking plaintext traffic

Modified: 7/20/2026

Deno: `fetch()` API sandbox bypass via missing DNS resolution check

Modified: 7/20/2026

fetch: Authorization headers not dropped when redirecting cross-origin

Modified: 1/7/2025

Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process

Modified: 2/20/2026

Insufficient permission checking in `Deno.makeTemp*` APIs

Modified: 9/10/2026

Regular Expression Denial of Service in Deno.upgradeWebSocket API

Modified: 11/8/2023

Deno vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Modified: 6/5/2025

Deno is Vulnerable to Command Injection on Windows During Batch File Execution

Modified: 10/8/2025

Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass

Modified: 2/3/2026

Deno's deno_runtime vulnerable to interactive permission prompt spoofing via improper ANSI stripping

Modified: 9/10/2026

Deno is vulnerable to race condition via interactive permission prompt spoofing

Modified: 9/10/2026

Deno's --deny-read check does not prevent permission bypass

Modified: 10/8/2025

Deno: Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks

Modified: 7/20/2026

Missing "--allow-net" permission check for built-in Node modules

Modified: 9/10/2026

Deno's --deny-write check does not prevent permission bypass

Modified: 10/13/2025

Interactive `run` permission prompt spoofing via improper ANSI neutralization

Modified: 9/10/2026

Deno's Node.js Compatibility Runtime has Cross-Session Data Contamination

Modified: 9/10/2026

Deno: Denial of service via non-ASCII bytes in WebSocket response headers

Modified: 6/17/2026

Deno's static imports inside dynamically imported modules do not adhere to permission checks

Modified: 7/8/2026

Deno run with --allow-read and --deny-read flags results in allowed

Modified: 9/10/2026

--allow-read / --allow-write permission bypass in `node:sqlite`

Modified: 12/29/2025