Vulnerability · Published Mar 5, 2024 · Assigned by GitHub_M

CVE-2024-27931Insufficient permission checking in `Deno.makeTemp*` APIs

Medium 5.8

In plain English

A medium-severity improper input validation in deno from denoland. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 3.1)5.8Medium

Exploit odds (30 days)0.5%top 57.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. Insufficient validation of parameters in `Deno.makeTemp*` APIs would allow for creation of files outside of the allowed directories. This may allow the user to overwrite important files on the system that may affect other systems. A user may provide a prefix or suffix to a `Deno.makeTemp*` API containing path traversal characters. This is fixed in Deno 1.41.1.

Affected products (as reported)

Vendor	Product	Versions
denoland	deno	< 1.41.1

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

References

https://github.com/denoland/deno/security/advisories/GHSA-hrqr-jv8w-v9jh x_refsource_CONFIRM