CVE-2021-32619
published 2021-05-28CVE-2021-32619: Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. In Deno versions 1.5.0 to 1.10.1, modules that are dynamically imported…
PriorityP349critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.11%
64.5th percentile
Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. In Deno versions 1.5.0 to 1.10.1, modules that are dynamically imported through `import()` or `new Worker` might have been able to bypass network and file system permission checks when statically importing other modules. The vulnerability has been patched in Deno release 1.10.2.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| deno | deno | >= 1.5.0 < 1.10.2 | 1.10.2 |
| deno | deno | >= 1.5.0 < 1.10.2 | 1.10.2 |
| denoland | deno | < 1.10.2 | 1.10.2 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Deno's static imports inside dynamically imported modules do not adhere to permission checks
osv·2021-09-23
CVE-2021-32619 [CRITICAL] Deno's static imports inside dynamically imported modules do not adhere to permission checks
Deno's static imports inside dynamically imported modules do not adhere to permission checks
### Impact
Modules that are dynamically imported through `import()` or `new Worker` might have been able to bypass network and file system permission checks when statically importing other modules. In Deno 1.5.x and 1.6.x only programs dynamically importing (especially transitively) untrusted code are affected. In Deno 1.7.x all programs importing (especially transitively) untrusted code are affected.
In effect an attacker in control of a (possibly remote) module in a programs module graph has been able to, **irrespective of permissions**:
1. initiate GET requests to arbitrary URLs on the internet (including LAN) and possibly read (parts of) the contents of these resources.
2. check for existenc
GHSA
Deno's static imports inside dynamically imported modules do not adhere to permission checks
ghsa·2021-09-23
CVE-2021-32619 [CRITICAL] CWE-285 Deno's static imports inside dynamically imported modules do not adhere to permission checks
Deno's static imports inside dynamically imported modules do not adhere to permission checks
### Impact
Modules that are dynamically imported through `import()` or `new Worker` might have been able to bypass network and file system permission checks when statically importing other modules. In Deno 1.5.x and 1.6.x only programs dynamically importing (especially transitively) untrusted code are affected. In Deno 1.7.x all programs importing (especially transitively) untrusted code are affected.
In effect an attacker in control of a (possibly remote) module in a programs module graph has been able to, **irrespective of permissions**:
1. initiate GET requests to arbitrary URLs on the internet (including LAN) and possibly read (parts of) the contents of these resources.
2. check for existenc
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-05-28
Published