Sandbox bypass leading to arbitrary code execution in Deno

Command Injection via incomplete shell metacharacter blocklist in node:child_process (bypass of CVE-2026-27190 fix)

Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process

Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass

Deno missing "--allow-net" permission check for built-in Node modules

Deno improperly handles resizable ArrayBuffer

Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust

Deno: TLS retry copies stale upgrade hook, risking plaintext traffic

Deno has --allow-read / --allow-write permission bypass in `node:sqlite`

Deno contains a permission escalation via open of privileged files with missing `--deny` flag

*const c_void / ExternalPointer unsoundness leading to use-after-free

Deno arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypass

Deno is vulnerable to interactive `run` permission prompt spoofing via improper ANSI neutralization

Deno Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)

Deno <=1.14.0 file sandbox does not handle symbolic links correctly

Deno's Node.js Compatibility Runtime has Cross-Session Data Contamination

Deno: Command Injection via spawnSync & spawn on Windows

Deno is Vulnerable to Command Injection on Windows During Batch File Execution

Deno node:crypto doesn't finalize cipher

Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket function, which contains regexes in the form…

Interactive permission prompt spoofing in Deno

Deno: Miller-Rabin Primality Test Allows Zero Rounds

Race condition when flushing input stream leads to permission prompt bypass

Deno Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks

Private npm registry support used scope auth token for downloading tarballs

Deno interactive permission prompt spoofing via improper ANSI stripping

Insufficient permission checking in `Deno.makeTemp*` APIs

Deno: BYONM module resolution allows `package.json` main path traversal to bypass `--allow-read` restrictions

Deno.env.toObject() ignores the variables listed in --deny-env and returns all environment variables

Deno run with --allow-read and --deny-read flags results in allowed

Deno's AES GCM authentication tags are not verified

Deno: process.loadEnvFile() bypasses env permission checks and mutates process.env with only read access

Deno: WebSocket API sandbox bypass via missing post-DNS check

Deno: `fetch()` API sandbox bypass via missing DNS resolution check

Deno's improper suffix match testing for DENO_AUTH_TOKENS

Deno: Denial of service via non-ASCII bytes in WebSocket response headers

Deno's --deny-read check does not prevent permission bypass

Deno's --deny-write check does not prevent permission bypass