https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 23:17:30 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-329656 EUVD-2026-329656 https://cve.radiocsirt.org/vuln/euvd-2026-329656 https://cve.radiocsirt.org/vuln/fkie_cve-2026-49406 <p>Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.12, when Deno was run in BYONM mode (nodeModulesDir: &#34;manual&#34;), the module resolver did not validate that a package&#39;s resolved entrypoint stayed within its node_modules/&lt;pkg&gt;/ directory. A malicious package.json whose main field contained .. segments was able to resolve to an arbitrary path on disk, and the resolver then read that file without consulting the --allow-read allowlist. This let a require(&#34;evil-pkg&#34;) call return the contents of a file that a direct Deno.readTextFileSync(...) call would have been blocked from reading. This vulnerability is fixed in 2.7.12.</p> <p>Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.12, when Deno was run in BYONM mode (nodeModulesDir: &#34;manual&#34;), the module resolver did not validate that a package&#39;s resolved entrypoint stayed within its node_modules/&lt;pkg&gt;/ directory. A malicious package.json whose main field contained .. segments was able to resolve to an arbitrary path on disk, and the resolver then read that file without consulting the --allow-read allowlist. This let a require(&#34;evil-pkg&#34;) call return the contents of a file that a direct Deno.readTextFileSync(...) call would have been blocked from reading. This vulnerability is fixed in 2.7.12.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-49406 https://cve.radiocsirt.org/vuln/ghsa-968w-xfqw-vp9q <p><strong>Affected:</strong> crates.io: deno</p> <p>## Summary</p> <p>When Deno was run in BYONM mode (`nodeModulesDir: &#34;manual&#34;`), the module resolver did not validate that a package&#39;s resolved entrypoint stayed within its `node_modules/&lt;pkg&gt;/` directory. A malicious `package.json` whose `main` field contained `..` segments was able to resolve to an arbitrary path on disk, and the resolver then read that file without consulting the `--allow-read` allowlist. This let a `require(&#34;evil-pkg&#34;)` call return the contents of a file that a direct `Deno.readTextFileSync(...)` call would have been blocked from reading.</p> <p>## Details</p> <p>In BYONM mode, Deno resolved npm packages directly from a user-managed `node_modules` tree. Resolution of `require(&#34;pkg&#34;)` proceeded by reading `pkg/package.json`, taking the `main` field, joining it to the package directory, and loading the result as a module.</p> <p>The path joined from `main` was not constrained to the package root. A `package.json` such as:</p> <p>```json { &#34;main&#34;: &#34;../../../secret.json&#34; } ```</p> <p>resolved to `node_modules/pkg/../../../secret.json`, escaping `node_modules` entirely. The BYONM permission check accepted any path that contained a `node_modules` component and did not reject `..` traversal, so the resolved path was loaded without a read-permission check.</p> <p>Because resolution loaded JSON entrypoints by parsing their contents and returning them through `require`, this exposed the contents of arbitrary `.json` files reachable by the OS user to the requiring code, even when `--allow-read` had been nar…</p> <p><strong>Affected:</strong> crates.io: deno</p> <p>## Summary</p> <p>When Deno was run in BYONM mode (`nodeModulesDir: &#34;manual&#34;`), the module resolver did not validate that a package&#39;s resolved entrypoint stayed within its `node_modules/&lt;pkg&gt;/` directory. A malicious `package.json` whose `main` field contained `..` segments was able to resolve to an arbitrary path on disk, and the resolver then read that file without consulting the `--allow-read` allowlist. This let a `require(&#34;evil-pkg&#34;)` call return the contents of a file that a direct `Deno.readTextFileSync(...)` call would have been blocked from reading.</p> <p>## Details</p> <p>In BYONM mode, Deno resolved npm packages directly from a user-managed `node_modules` tree. Resolution of `require(&#34;pkg&#34;)` proceeded by reading `pkg/package.json`, taking the `main` field, joining it to the package directory, and loading the result as a module.</p> <p>The path joined from `main` was not constrained to the package root. A `package.json` such as:</p> <p>```json { &#34;main&#34;: &#34;../../../secret.json&#34; } ```</p> <p>resolved to `node_modules/pkg/../../../secret.json`, escaping `node_modules` entirely. The BYONM permission check accepted any path that contained a `node_modules` component and did not reject `..` traversal, so the resolved path was loaded without a read-permission check.</p> <p>Because resolution loaded JSON entrypoints by parsing their contents and returning them through `require`, this exposed the contents of arbitrary `.json` files reachable by the OS user to the requiring code, even when `--allow-read` had been nar…</p> https://cve.radiocsirt.org/vuln/ghsa-968w-xfqw-vp9q