Skip to content
Noroxi

deno records

39 published records for vendor deno.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
8
With a fix record
94.9%
Median publish → KEV
No record has entered KEV

Records by year

  1. 21
  2. 22
  3. 23
  4. 24
  5. 25
  6. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

39 records
  • CVE-2026-27190
    40Plan

    Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process

    CriticalCVSS 9.8No exploitEPSS 3%

    deno · denoFeb 20, 2026

  • CVE-2021-42139
    40Plan

    Deno Standard Modules before 0.107.0 allows Code Injection via an untrusted YAML file in certain configurations.

    CriticalCVSS 9.8No exploitEPSS 2%

    deno · deno standard modulesOct 11, 2021

  • CVE-2026-32260
    40Plan

    Command Injection via incomplete shell metacharacter blocklist in node:child_process (bypass of CVE-2026-27190 fix)

    CriticalCVSS 9.8No exploitEPSS 2%

    deno · denoMar 12, 2026

  • CVE-2022-24783
    40Plan

    Sandbox bypass leading to arbitrary code execution in Deno

    CriticalCVSS 10.0No exploitEPSS 1%

    deno · denoMar 25, 2022

  • CVE-2021-32619
    39Monitor

    Static imports inside dynamically imported modules do not adhere to permission checks

    CriticalCVSS 9.8No exploitEPSS 1%

    deno · denoMay 28, 2021

  • CVE-2023-28445
    39Monitor

    Deno improperly handles resizable ArrayBuffer

    CriticalCVSS 9.8No exploitEPSS 0%

    deno · denoMar 23, 2023

  • CVE-2026-22864
    39Monitor

    Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass

    CriticalCVSS 9.8No exploitEPSS 0%

    deno · denoJan 15, 2026

  • CVE-2023-33966
    39Monitor

    Deno missing "--allow-net" permission check for built-in Node modules

    CriticalCVSS 9.8No exploitEPSS 0%

    deno · denoMay 31, 2023

  • CVE-2024-27933
    36Monitor

    Deno arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypass

    HighCVSS 8.8No exploitEPSS 2%

    deno · denoMar 20, 2024

  • CVE-2024-34346
    36Monitor

    Deno contains a permission escalation via open of privileged files with missing `--deny` flag

    CriticalCVSS 9.0No exploitEPSS 0%

    deno · denoMay 7, 2024

  • CVE-2026-44726
    36Monitor

    Deno: TLS retry copies stale upgrade hook, risking plaintext traffic

    CriticalCVSS 9.1No exploitEPSS 0%

    deno · denoJun 23, 2026

  • CVE-2026-22863
    36Monitor

    Deno node:crypto doesn't finalize cipher

    CriticalCVSS 9.2No exploitEPSS 0%

    deno · denoJan 15, 2026

  • CVE-2023-28446
    35Monitor

    Deno is vulnerable to interactive `run` permission prompt spoofing via improper ANSI neutralization

    HighCVSS 8.8No exploitEPSS 1%

    deno · denoMar 24, 2023

  • CVE-2024-27934
    35Monitor

    *const c_void / ExternalPointer unsoundness leading to use-after-free

    HighCVSS 8.8No exploitEPSS 0%

    deno · denoMar 20, 2024

  • CVE-2025-61787
    33Monitor

    Deno is Vulnerable to Command Injection on Windows During Batch File Execution

    HighCVSS 8.1No exploitEPSS 2%

    deno · denoOct 8, 2025

  • CVE-2024-27935
    33Monitor

    Deno's Node.js Compatibility Runtime has Cross-Session Data Contamination

    HighCVSS 8.3No exploitEPSS 0%

    deno · denoMar 20, 2024

  • CVE-2021-41641
    33Monitor

    Deno <=1.14.0 file sandbox does not handle symbolic links correctly.

    HighCVSS 8.4No exploitEPSS 0%

    deno · denoJun 12, 2022

  • CVE-2026-49401
    33Monitor

    Deno Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)

    HighCVSS 8.4No exploitEPSS 0%

    deno · denoJun 23, 2026

  • CVE-2026-49402
    32Monitor

    Deno: Command Injection via spawnSync & spawn on Windows

    HighCVSS 8.1No exploitEPSS 0%

    deno · denoJun 23, 2026

  • CVE-2023-26103
    30Monitor

    Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket functi

    HighCVSS 7.5No exploitEPSS 1%

    deno · denoFeb 25, 2023

  • CVE-2023-22499
    30Monitor

    Interactive permission prompt spoofing in Deno

    HighCVSS 7.5No exploitEPSS 0%

    deno · denoJan 17, 2023

  • CVE-2025-24015
    30Monitor

    Deno's AES GCM authentication tags are not verified

    HighCVSS 7.7No exploitEPSS 0%

    deno · denoJun 3, 2025

  • CVE-2024-32477
    29Monitor

    Race condition when flushing input stream leads to permission prompt bypass

    HighCVSS 7.4No exploitEPSS 0%

    deno · denoApr 18, 2024

  • CVE-2026-49440
    29Monitor

    Deno: Miller-Rabin Primality Test Allows Zero Rounds

    HighCVSS 7.4No exploitEPSS 0%

    deno · denoJun 23, 2026

  • CVE-2024-27936
    26Monitor

    Deno interactive permission prompt spoofing via improper ANSI stripping

    MediumCVSS 6.5No exploitEPSS 0%

    deno · denoMar 20, 2024