PT-2024-22145 · Deno · Deno

Ericcornelissen · Published 2024-03-05 · Updated 2026-04-14 · CVE-2024-27931

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Deno versions prior to 1.41.1

Description Insufficient validation of parameters in Deno.makeTemp* APIs would allow for creation of files outside of the allowed directories. This may allow the user to overwrite important files on the system that may affect other systems. A user may provide a prefix or suffix to a Deno.makeTemp* API containing path traversal characters.

Recommendations For Deno versions prior to 1.41.1, update to Deno 1.41.1 to resolve the issue. As a temporary workaround, consider restricting the use of the Deno.makeTemp* APIs to prevent potential exploitation. Avoid using prefixes or suffixes containing path traversal characters in the Deno.makeTemp* APIs until the issue is resolved.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2024-27931

GHSA-HRQR-JV8W-V9JH

JLSEC-2026-103

Affected Products

Deno

References · 11

• 🔥 https://github.com/denoland/deno/security/advisories/GHSA-hrqr-jv8w-v9jh · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27931.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-27931 · Security Note
• https://osv.dev/vulnerability/GHSA-hrqr-jv8w-v9jh · Vendor Advisory
• https://osv.dev/vulnerability/JLSEC-2026-103 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-27931 · Vendor Advisory
• https://github.com/denoland/deno · Note
• https://t.me/cvenotify/73047 · Telegram Post
• https://github.com/advisories/GHSA-hrqr-jv8w-v9jh · Note
• https://t.me/cvenotify/73029 · Telegram Post
• https://twitter.com/CVEnew/status/1765057866258424007 · Twitter Post