PT-2024-22150 · Deno · Deno

Ry0Tak · Published 2024-03-05 · Updated 2026-04-14 · CVE-2024-27936

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Deno versions 1.32.1 through 1.40.x

Description A maliciously crafted permission request can show a spoofed permission prompt by inserting a broken ANSI escape sequence into the request contents. Deno strips any ANSI escape sequences from the permission prompt, but permissions given to the program are based on the contents that contain the ANSI escape sequences. This allows a malicious Deno program to display the wrong file path or program name to the user.

Recommendations For Deno versions 1.32.1 through 1.40.x, update to version 1.41.0 or later to resolve the issue. As a temporary workaround, consider disabling the use of ANSI escape sequences in permission requests until a patch is applied. Restrict access to sensitive files and programs to minimize the risk of exploitation. Avoid using broken ANSI codes in permission prompts to prevent spoofing.

Exploit

Fix

Weakness Enumeration

CWE-150

Related Identifiers

CVE-2024-27936

GHSA-M4PQ-FV2W-6HRW

JLSEC-2026-105

Affected Products

Deno

References · 12

• 🔥 https://github.com/denoland/deno/security/advisories/GHSA-m4pq-fv2w-6hrw · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27936.json · Exploit
• https://github.com/denoland/deno/commit/78d430103a8f6931154ddbbe19d36f3b8630286d · Patch
• https://github.com/denoland/deno/commit/7e6b94231290020b55f1d08fb03ea8132781abc5 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-27936 · Security Note
• https://osv.dev/vulnerability/CVE-2024-27936 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m4pq-fv2w-6hrw · Vendor Advisory
• https://osv.dev/vulnerability/JLSEC-2026-105 · Vendor Advisory
• https://github.com/denoland/deno · Note
• https://t.me/cvenotify/82582 · Telegram Post
• https://twitter.com/cracbot/status/1771321525402018204 · Twitter Post
• https://github.com/advisories/GHSA-m4pq-fv2w-6hrw · Note