https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 00:04:09 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-28006 EUVD-2026-28006 https://cve.radiocsirt.org/vuln/euvd-2026-28006 https://cve.radiocsirt.org/vuln/fkie_cve-2021-32619 <p>Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. In Deno versions 1.5.0 to 1.10.1, modules that are dynamically imported through `import()` or `new Worker` might have been able to bypass network and file system permission checks when statically importing other modules. The vulnerability has been patched in Deno release 1.10.2.</p> <p>Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. In Deno versions 1.5.0 to 1.10.1, modules that are dynamically imported through `import()` or `new Worker` might have been able to bypass network and file system permission checks when statically importing other modules. The vulnerability has been patched in Deno release 1.10.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-32619 https://cve.radiocsirt.org/vuln/ghsa-xpwj-7v8q-mcgj <p><strong>Affected:</strong> crates.io: deno</p> <p>### Impact</p> <p>Modules that are dynamically imported through `import()` or `new Worker` might have been able to bypass network and file system permission checks when statically importing other modules. In Deno 1.5.x and 1.6.x only programs dynamically importing (especially transitively) untrusted code are affected. In Deno 1.7.x all programs importing (especially transitively) untrusted code are affected.</p> <p>In effect an attacker in control of a (possibly remote) module in a programs module graph has been able to, **irrespective of permissions**: 1. initiate GET requests to arbitrary URLs on the internet (including LAN) and possibly read (parts of) the contents of these resources. 2. check for existence of arbitrary paths on the file system, and possibly read (parts of) the contents of these files.</p> <p>In Deno 1.5.x (October 27th, 2020) and Deno 1.6.x (December 8th, 2020) the attacker module had to have been granted permissions to load dynamically through the network / fs read permission. Since Deno 1.7.x (January 19th, 2021) this vulnerability was able to be exploited in a fully sandboxed isolate (without any permissions). This vulnerability was not present in releases prior to 1.5.0.</p> <p>Arbitrary non-GET requests, control over request headers, or file system writes are not possible through this vulnerability. Users of the `deno_core`, `deno_runtime`, or other `deno_*` crates are not affected. This is a Deno CLI only vulnerability.</p> <p>We are relatively confident this was not abused in…</p> <p><strong>Affected:</strong> crates.io: deno</p> <p>### Impact</p> <p>Modules that are dynamically imported through `import()` or `new Worker` might have been able to bypass network and file system permission checks when statically importing other modules. In Deno 1.5.x and 1.6.x only programs dynamically importing (especially transitively) untrusted code are affected. In Deno 1.7.x all programs importing (especially transitively) untrusted code are affected.</p> <p>In effect an attacker in control of a (possibly remote) module in a programs module graph has been able to, **irrespective of permissions**: 1. initiate GET requests to arbitrary URLs on the internet (including LAN) and possibly read (parts of) the contents of these resources. 2. check for existence of arbitrary paths on the file system, and possibly read (parts of) the contents of these files.</p> <p>In Deno 1.5.x (October 27th, 2020) and Deno 1.6.x (December 8th, 2020) the attacker module had to have been granted permissions to load dynamically through the network / fs read permission. Since Deno 1.7.x (January 19th, 2021) this vulnerability was able to be exploited in a fully sandboxed isolate (without any permissions). This vulnerability was not present in releases prior to 1.5.0.</p> <p>Arbitrary non-GET requests, control over request headers, or file system writes are not possible through this vulnerability. Users of the `deno_core`, `deno_runtime`, or other `deno_*` crates are not affected. This is a Deno CLI only vulnerability.</p> <p>We are relatively confident this was not abused in…</p> https://cve.radiocsirt.org/vuln/ghsa-xpwj-7v8q-mcgj https://cve.radiocsirt.org/vuln/gsd-2021-32619 gsd-2021-32619 https://cve.radiocsirt.org/vuln/gsd-2021-32619