Bartlomiej

**Name of the Vulnerable Software and Affected Versions** Deno versions prior to 2.7.12 **Description** When running in BYONM mode (`nodeModulesDir: "manual"`), the module resolver fails to validate that a package's resolved entrypoint remains within its `node modules/<pkg>/` directory. A malicious `package.json` containing `..` segments in the `main` field can resolve to an arbitrary path on disk. The resolver then reads this file without consulting the `--allow-read` allowlist, allowing a `require()` call to return the contents of files that would otherwise be blocked by `Deno.readTextFileSync()`. This issue specifically exposes the contents of arbitrary `.json` files reachable by the OS user, potentially leaking configuration and credential files, even when read permissions are restricted to a specific directory. **Recommendations** Update to version 2.7.12. As a temporary workaround, avoid using BYONM mode (`nodeModulesDir: "manual"`) for projects that depend on untrusted packages. Audit `main` fields in `package.json` files within `node modules` for `..` segments before execution.