DE
Product
deno
38
CVEs
0
On KEV
10.0
Max CVSS
1
New 30D
Severity mix
Critical 9High 13Medium 14Low 2
Watch
Add deno to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-27934 | 8.8 | Mar 6 | *const c_void / ExternalPointer unsoundness leading to use-after-free Affected: >= 1.36.2, < 1.40.3 |
| CVE-2024-27933 | 8.8 | Mar 6 | Deno arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypass Affected: = 1.39.0 |
| CVE-2023-28446 | 8.8 | Mar 24 | Deno is vulnerable to interactive `run` permission prompt spoofing via improper ANSI neutralization Affected: >= 1.8.0, < 1.31.2 |
| CVE-2026-49401 | 8.4 | Jun 23 | Deno Permission Bypass via Unicode Normalization Mismatch on macOS (APFS) Affected: < 2.7.14 |
| CVE-2024-27935 | 8.3 | Mar 6 | Deno's Node.js Compatibility Runtime has Cross-Session Data Contamination Affected: >= 1.35.1, < 1.36.3 |
| CVE-2026-103473 | 8.1 | Sep 30 | Deno 2.7.0 through 2.9.7 Command Injection via node:child_process Affected: 2.7.0 through 2.9.7 |
| CVE-2026-49402 | 8.1 | Jun 23 | Deno: Command Injection via spawnSync & spawn on Windows Affected: < 2.7.10 |
| CVE-2025-61787 | 8.1 | Oct 8 | Deno is Vulnerable to Command Injection on Windows During Batch File Execution Affected: >= 2.3.0, < 2.5.3; < 2.2.15 |
| CVE-2026-22863 | 7.5 | Jan 15 | Deno node:crypto doesn't finalize cipher Affected: < 2.6.0 |
| CVE-2025-21620 | 7.5 | Jan 6 | Deno's authorization headers not dropped when redirecting cross-origin Affected: < 2.1.2 |
| CVE-2023-22499 | 7.5 | Jan 17 | Interactive permission prompt spoofing in Deno Affected: >= 1.9, < 1.29.3 |
| CVE-2026-49440 | 7.4 | Jun 23 | Deno: Miller-Rabin Primality Test Allows Zero Rounds Affected: < 2.8.1 |
| CVE-2024-32477 | 7.4 | Apr 18 | Race condition when flushing input stream leads to permission prompt bypass Affected: < 1.42.2 |
Showing 13