Skip to main content
cve.nowby Sazabi
← crates.io
crates.ioPackage

deno_runtime

6 known vulnerabilities (1 critical, 3 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
6 · 1 critical, 3 high, 2 medium
Registry
crates.io

Advisories 6

  • CVE-2025-48934Medium 5.5

    Deno.env.toObject() ignores the variables listed in --deny-env and returns all environment variables

    Affected: fixed in 0.212.0.

  • CVE-2025-48888Medium 5.5

    Deno run with --allow-read and --deny-read flags results in allowed

    Affected: from 0.150.0, fixed in 0.212.0.

  • Deno interactive permission prompt spoofing via improper ANSI stripping

    Affected: from 0.103.0, fixed in 0.147.0.

  • Deno missing "--allow-net" permission check for built-in Node modules

    Affected: from 0.114.0, fixed in 0.115.0.

  • Deno is vulnerable to interactive `run` permission prompt spoofing via improper ANSI neutralization

    Affected: from 1.8.0, fixed in 1.31.2.

  • CVE-2023-28445Critical 10.0

    Deno improperly handles resizable ArrayBuffer

    Affected: from 0.102.0, fixed in 0.103.0.