CVE-2026-49406

Summary

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.12, when Deno was run in BYONM mode (nodeModulesDir: "manual"), the module resolver did not validate that a package's resolved entrypoint stayed within its node_modules/<pkg>/ directory. A malicious package.json whose main field contained .. segments was able to resolve to an arbitrary path on disk, and the resolver then read that file without consulting the –allow-read allowlist. This let a require("evil-pkg") call return the contents of a file that a direct Deno.readTextFileSync(…) call would have been blocked from reading. This vulnerability is fixed in 2.7.12.

Affected Software

Weaknesses

• CWE-22: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

Additional References

• https://github.com/denoland/deno/security/advisories/GHSA-968w-xfqw-vp9q

References

• https://github.com/denoland/deno/security/advisories/GHSA-968w-xfqw-vp9q

• ←Previous
• Next→