PT-2021-19811 · Deno · Deno

Lucacasonato + 1 · Published 2021-05-28 · Updated 2026-04-14 · CVE-2021-32619

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Deno versions 1.5.0 through 1.10.1

Description The issue concerns modules dynamically imported through import() or new Worker that might bypass network and file system permission checks when statically importing other modules. An attacker in control of a module in a program's module graph could initiate GET requests to arbitrary URLs and possibly read the contents of these resources, or check for existence of arbitrary paths on the file system and possibly read the contents of these files. This vulnerability was not present in releases prior to 1.5.0 and was not abused in the wild, as indicated by the lack of reports and the default behavior of Deno printing a "Download" message when remote imports are downloaded.

Recommendations For Deno versions 1.5.0 through 1.10.1, upgrade to Deno release 1.10.2 by running the deno upgrade command to patch the vulnerability. At the moment, there is no workaround for this issue other than upgrading to the patched version.

Fix

Incorrect Authorization

Improper Authorization

Weakness Enumeration

CWE-863

CWE-285

Related Identifiers

CVE-2021-32619

GHSA-XPWJ-7V8Q-MCGJ

JLSEC-2026-98

Affected Products

Deno

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2021-32619 · Security Note
• https://osv.dev/vulnerability/CVE-2021-32619 · Vendor Advisory
• https://osv.dev/vulnerability/JLSEC-2026-98 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xpwj-7v8q-mcgj · Vendor Advisory
• https://github.com/denoland/deno · Note
• https://github.com/denoland/deno/security/advisories/GHSA-xpwj-7v8q-mcgj · Note
• https://github.com/advisories/GHSA-xpwj-7v8q-mcgj · Note