PT-2026-50147 · Denoland · Deno
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Deno versions prior to 2.7.12
Description
When running in BYONM mode (
nodeModulesDir: "manual"), the module resolver fails to validate that a package's resolved entrypoint remains within its node modules/<pkg>/ directory. A malicious package.json containing .. segments in the main field can resolve to an arbitrary path on disk. The resolver then reads this file without consulting the --allow-read allowlist, allowing a require() call to return the contents of files that would otherwise be blocked by Deno.readTextFileSync(). This issue specifically exposes the contents of arbitrary .json files reachable by the OS user, potentially leaking configuration and credential files, even when read permissions are restricted to a specific directory.Recommendations
Update to version 2.7.12.
As a temporary workaround, avoid using BYONM mode (
nodeModulesDir: "manual") for projects that depend on untrusted packages.
Audit main fields in package.json files within node modules for .. segments before execution.Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Deno