CVE-2024-27936 — Improper Neutralization of Escape, Meta, or Control Sequences in Deno

CWE-150 — Improper Neutralization of Escape, Meta, or Control Sequences3 documents3 sources
Severity
6.5MEDIUMNVD
GHSA8.8OSV8.8
EPSS
0.6%
top 31.20%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
DenoDeno RuntimeDenoland Deno
Timeline
Latest updateMar 5
PublishedMar 21

Description

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. Starting in version 1.32.1 and prior to version 1.41.0 of the deno library, maliciously crafted permission request can show the spoofed permission prompt by inserting a broken ANSI escape sequence into the request contents. Deno is stripping any ANSI escape sequences from the permission prompt, but permissions given to the program are based on the contents that contain the ANSI escape sequences. Any Deno program can …

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages5 packages

▶NVDdeno/deno_runtime0.103.0 — 0.147.0
▶crates.iodeno/deno_runtime0.103.0 — 0.147.0
▶NVDdeno/deno1.32.1 — 1.41.0
▶crates.iodeno/deno1.32.1 — 1.41.0
▶CVEListV5denoland/deno>= 1.32.1, < 1.41.0

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
GHSA
Deno's deno_runtime vulnerable to interactive permission prompt spoofing via improper ANSI stripping↗2024-03-05
▶
OSV
Deno's deno_runtime vulnerable to interactive permission prompt spoofing via improper ANSI stripping↗2024-03-05
▶