PT-2026-50155 · Deno · Deno

Fallintoplace · CVE-2026-49983 · Published 2026-06-16 · Updated 2026-06-29

Positive Technologies (AI Summary)

CVSS v3.1

5.2

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Deno versions prior to 2.8.1

Description Environment access is managed by the env permission, which can be restricted via --deny-env or an allowlist using --allow-env=FOO,BAR. The process.loadEnvFile() function, a Node-compatible API for loading variables from a .env file, fails to honor these restrictions. It only verifies that the program has read permission for the dotenv file and subsequently writes every key from that file into the process environment, even if environment access is explicitly denied. Consequently, combining --allow-read with a writable or attacker-controlled .env file allows the bypass of --deny-env.

Recommendations Update to version 2.8.1. As a temporary workaround, avoid using the process.loadEnvFile() function until the update is applied.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-49983

GHSA-4C8G-JVCX-V4HV

Affected Products

Deno

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49983.json · Exploit
• https://github.com/denoland/deno/security/advisories/GHSA-4c8g-jvcx-v4hv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-49983 · Security Note
• https://osv.dev/vulnerability/CVE-2026-49983 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4c8g-jvcx-v4hv · Vendor Advisory
• https://github.com/denoland/deno · Note
• https://t.me/CVEtracker/57698 · Telegram Post
• https://t.me/cveNotify/178437 · Telegram Post