HIGH8.4

GHSA-67hm-27mx-9cg7

Link Following in Deno

Details

Deno <=1.14.0 file sandbox does not handle symbolic links correctly. When running Deno with specific write access, the Deno.symlink method can be used to gain access to any directory.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/deno

Introduced in: 0Fixed in: 1.16.0

Upgrade deno to 1.16.0 or newer (ecosystem crates.io).

References

https://nvd.nist.gov/vuln/detail/CVE-2021-41641[ADVISORY]
https://github.com/denoland/deno/issues/12152[WEB]
https://github.com/denoland/deno/pull/12554[WEB]
https://github.com/denoland/deno/commit/d44011a69e0674acfa9c59bd7ad7f0523eb61d42[WEB]
https://hackers.report/report/614876917a7b150012836bb8[WEB]