denoland deno

• CVE-2026-103473 High 8.1 Deno 2.7.0 through 2.9.7 Command Injection via node:child_process 1.5%
• CVE-2026-55517 Medium 4.3 Deno: Denial of service via non-ASCII bytes in WebSocket response headers 0.3%
• CVE-2026-44726 High 7.4 Deno: TLS retry copies stale upgrade hook, risking plaintext traffic 0.2%
• CVE-2026-49401 High 7.3 Deno Permission Bypass via Unicode Normalization Mismatch on macOS (APFS) 0.2%
• CVE-2026-49402 High 8.1 Deno: Command Injection via spawnSync & spawn on Windows 0.4%
• CVE-2026-49406 Medium 5.5 Deno: BYONM module resolution allows `package.json` main path traversal to bypass `--allow-read` restrictions 0.2%
• CVE-2026-49411 Medium 6.5 Deno Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks 0.2%
• CVE-2026-49983 Medium 5.2 Deno: process.loadEnvFile() bypasses env permission checks and mutates process.env with only read access 0.1%
• CVE-2026-49860 Medium 5.2 Deno: WebSocket API sandbox bypass via missing post-DNS check 0.1%
• CVE-2026-49859 Medium 5.2 Deno: `fetch()` API sandbox bypass via missing DNS resolution check 0.1%
• CVE-2026-49440 High 7.4 Deno: Miller-Rabin Primality Test Allows Zero Rounds 0.2%
• CVE-2026-32260 High 8.1 Command Injection via incomplete shell metacharacter blocklist in node:child_process (bypass of CVE-2026-27190 fix) 1.5%
• CVE-2026-27190 High 8.1 Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process 2.5%
• CVE-2026-22864 High 8.1 Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass 0.7%
• CVE-2026-22863 Critical 9.2 Deno node:crypto doesn't finalize cipher 0.2%
• CVE-2025-61787 High 8.1 Deno is Vulnerable to Command Injection on Windows During Batch File Execution 2.1%
• CVE-2025-61786 Low 3.3 Deno's --deny-read check does not prevent permission bypass 0.2%
• CVE-2025-61785 Low 3.3 Deno's --deny-write check does not prevent permission bypass 0.2%
• CVE-2025-48935 Medium 5.5 Deno has --allow-read / --allow-write permission bypass in `node:sqlite` 0.5%
• CVE-2025-48934 Medium 5.5 Deno.env.toObject() ignores the variables listed in --deny-env and returns all environment variables 0.4%
• CVE-2025-48888 Medium 5.5 Deno run with --allow-read and --deny-read flags results in allowed 0.4%
• CVE-2025-24015 High 7.7 Deno's AES GCM authentication tags are not verified 0.3%
• CVE-2025-21620 High 7.5 Deno's authorization headers not dropped when redirecting cross-origin 0.5%
• CVE-2024-32468 Medium 5.4 Improper neutralization of input during web page generation ("Cross-site Scripting") in deno_doc HTML generator 0.4%
• CVE-2024-37150 High 7.6 Private npm registry support used scope auth token for downloading tarballs 0.4%
• CVE-2024-34346 High 8.5 Deno contains a permission escalation via open of privileged files with missing `--deny` flag 0.4%
• CVE-2024-32477 High 7.7 Race condition when flushing input stream leads to permission prompt bypass 0.3%
• CVE-2024-27936 High 8.8 Deno interactive permission prompt spoofing via improper ANSI stripping 0.9%
• CVE-2024-27935 High 7.2 Deno's Node.js Compatibility Runtime has Cross-Session Data Contamination 0.7%
• CVE-2024-27934 High 8.4 *const c_void / ExternalPointer unsoundness leading to use-after-free 0.4%
• CVE-2024-27933 High 8.3 Deno arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypass 2.3%
• CVE-2024-27932 Medium 4.6 Deno's improper suffix match testing for DENO_AUTH_TOKENS 0.6%
• CVE-2024-27931 Medium 5.8 Insufficient permission checking in `Deno.makeTemp*` APIs 0.5%
• CVE-2023-33966 High 8.6 Deno missing "--allow-net" permission check for built-in Node modules 0.6%
• CVE-2023-28446 High 8.8 Deno is vulnerable to interactive `run` permission prompt spoofing via improper ANSI neutralization 1.1%
• CVE-2023-28445 Critical 10.0 Deno improperly handles resizable ArrayBuffer 1.0%
• CVE-2023-22499 High 7.5 Interactive permission prompt spoofing in Deno 0.6%
• CVE-2022-24783 Critical 10.0 Sandbox bypass leading to arbitrary code execution in Deno 1.1%
• CVE-2021-32619 Critical 9.8 Static imports inside dynamically imported modules do not adhere to permission checks 1.1%