Ddenoland

Products

Exploited and recent CVEs

• CVE-2026-103473 High 8.1 Deno 2.7.0 through 2.9.7 Command Injection via node:child_process 1.5%
• CVE-2026-55517 Medium 4.3 Deno: Denial of service via non-ASCII bytes in WebSocket response headers 0.3%
• CVE-2026-44726 High 7.4 Deno: TLS retry copies stale upgrade hook, risking plaintext traffic 0.2%
• CVE-2026-49401 High 7.3 Deno Permission Bypass via Unicode Normalization Mismatch on macOS (APFS) 0.2%
• CVE-2026-49402 High 8.1 Deno: Command Injection via spawnSync & spawn on Windows 0.4%
• CVE-2026-49406 Medium 5.5 Deno: BYONM module resolution allows `package.json` main path traversal to bypass `--allow-read` restrictions 0.2%
• CVE-2026-49411 Medium 6.5 Deno Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks 0.2%
• CVE-2026-49983 Medium 5.2 Deno: process.loadEnvFile() bypasses env permission checks and mutates process.env with only read access 0.1%
• CVE-2026-49860 Medium 5.2 Deno: WebSocket API sandbox bypass via missing post-DNS check 0.1%
• CVE-2026-49859 Medium 5.2 Deno: `fetch()` API sandbox bypass via missing DNS resolution check 0.1%
• CVE-2026-49440 High 7.4 Deno: Miller-Rabin Primality Test Allows Zero Rounds 0.2%
• CVE-2026-32260 High 8.1 Command Injection via incomplete shell metacharacter blocklist in node:child_process (bypass of CVE-2026-27190 fix) 1.5%
• CVE-2026-27190 High 8.1 Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process 2.5%
• CVE-2026-22864 High 8.1 Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass 0.7%
• CVE-2026-22863 Critical 9.2 Deno node:crypto doesn't finalize cipher 0.2%
• CVE-2025-61787 High 8.1 Deno is Vulnerable to Command Injection on Windows During Batch File Execution 2.1%
• CVE-2025-61786 Low 3.3 Deno's --deny-read check does not prevent permission bypass 0.2%
• CVE-2025-61785 Low 3.3 Deno's --deny-write check does not prevent permission bypass 0.2%
• CVE-2025-55195 High 7.3 @std/toml Prototype Pollution in Node.js and Browser 0.4%
• CVE-2025-48935 Medium 5.5 Deno has --allow-read / --allow-write permission bypass in `node:sqlite` 0.5%
• CVE-2025-48934 Medium 5.5 Deno.env.toObject() ignores the variables listed in --deny-env and returns all environment variables 0.4%
• CVE-2025-48888 Medium 5.5 Deno run with --allow-read and --deny-read flags results in allowed 0.4%
• CVE-2025-24015 High 7.7 Deno's AES GCM authentication tags are not verified 0.3%
• CVE-2025-21620 High 7.5 Deno's authorization headers not dropped when redirecting cross-origin 0.5%
• CVE-2024-32468 Medium 5.4 Improper neutralization of input during web page generation ("Cross-site Scripting") in deno_doc HTML generator 0.4%
• CVE-2024-52793 Medium 5.1 XSS vulnerability in serveDir API of @std/http/file-server on POSIX systems 0.6%
• CVE-2024-37150 High 7.6 Private npm registry support used scope auth token for downloading tarballs 0.4%
• CVE-2024-34346 High 8.5 Deno contains a permission escalation via open of privileged files with missing `--deny` flag 0.4%
• CVE-2024-32477 High 7.7 Race condition when flushing input stream leads to permission prompt bypass 0.3%
• CVE-2024-27936 High 8.8 Deno interactive permission prompt spoofing via improper ANSI stripping 0.9%