PT-2024-22146 · Deno · Deno

Easrng · Published 2024-03-06 · Updated 2026-04-14 · CVE-2024-27932

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Deno versions 1.8.0 through 1.40.3

Description Deno improperly checks that an import specifier's hostname is equal to or a child of a token's hostname, which can cause tokens to be sent to servers they shouldn't be sent to. An auth token intended for a specific domain may be sent to a different domain. Anyone who uses DENO AUTH TOKENS and imports potentially untrusted code is affected.

Recommendations For Deno versions 1.8.0 through 1.40.3, update to version 1.40.4 or later to resolve the issue. As a temporary workaround, consider avoiding the use of DENO AUTH TOKENS with potentially untrusted code until a patch is applied. Restrict access to sensitive domains to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2024-27932

GHSA-5FRW-4RWQ-XHCR

JLSEC-2026-104

Affected Products

Deno

References · 11

• 🔥 https://github.com/denoland/deno/security/advisories/GHSA-5frw-4rwq-xhcr · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27932.json · Exploit
• https://github.com/denoland/deno/commit/de23e3b60b066481cc390f459497d5bef42a899b · Patch
• https://osv.dev/vulnerability/JLSEC-2026-104 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-27932 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-27932 · Security Note
• https://osv.dev/vulnerability/GHSA-5frw-4rwq-xhcr · Vendor Advisory
• https://github.com/denoland/deno · Note
• https://github.com/denoland/deno/blob/3f4639c330a31741b0efda2f93ebbb833f4f95bc/cli/auth_tokens.rs#L89 · Note
• https://twitter.com/VulmonFeeds/status/1770719175767368183 · Twitter Post
• https://github.com/advisories/GHSA-5frw-4rwq-xhcr · Note