Fallintoplace

**Name of the Vulnerable Software and Affected Versions** Deno versions prior to 2.8.1 **Description** Environment access is managed by the `env` permission, which can be restricted via `--deny-env` or an allowlist using `--allow-env=FOO,BAR`. The `process.loadEnvFile()` function, a Node-compatible API for loading variables from a `.env` file, fails to honor these restrictions. It only verifies that the program has read permission for the dotenv file and subsequently writes every key from that file into the process environment, even if environment access is explicitly denied. Consequently, combining `--allow-read` with a writable or attacker-controlled `.env` file allows the bypass of `--deny-env`. **Recommendations** Update to version 2.8.1. As a temporary workaround, avoid using the `process.loadEnvFile()` function until the update is applied.