https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 07:43:10 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-329635 EUVD-2026-329635 https://cve.radiocsirt.org/vuln/euvd-2026-329635 https://cve.radiocsirt.org/vuln/fkie_cve-2026-49860 <p>Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, when a WebSocket connection was opened, Deno checked the destination hostname against --deny-net rules but did not re-check the IP addresses that hostname resolved to. An attacker-controlled script could use a specially crafted domain name that passes the hostname check yet resolves to a denied IP, bypassing the network restriction entirely. This vulnerability is fixed in 2.8.1.</p> <p>Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, when a WebSocket connection was opened, Deno checked the destination hostname against --deny-net rules but did not re-check the IP addresses that hostname resolved to. An attacker-controlled script could use a specially crafted domain name that passes the hostname check yet resolves to a denied IP, bypassing the network restriction entirely. This vulnerability is fixed in 2.8.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-49860 https://cve.radiocsirt.org/vuln/ghsa-83pc-3rw9-qpwj <p><strong>Affected:</strong> crates.io: deno</p> <p>## Summary</p> <p>When a WebSocket connection was opened, Deno checked the destination hostname against `--deny-net` rules but did not re-check the IP addresses that hostname resolved to. An attacker-controlled script could use a specially crafted domain name that passes the hostname check yet resolves to a denied IP, bypassing the network restriction entirely.</p> <p>## Impact</p> <p>Code running under `--deny-net` could connect to hosts that the user intended to block. In practice this means network isolation rules — for example, blocking access to `localhost` or internal services — could be silently circumvented by a malicious or compromised dependency.</p> <p>`Deno.connect` and `fetch()` were not affected by this specific issue (a companion advisory covers `fetch()`).</p> <p>## Who is affected</p> <p>Users who:</p> <p>- run untrusted or third-party code with `deno run`, and - rely on `--deny-net` to restrict which hosts that code can reach.</p> <p>If you do not use `--deny-net`, or if you only run fully trusted code, you are not affected.</p> <p>## Workaround</p> <p>No workaround is available short of upgrading. If upgrading immediately is not possible, avoid granting `--allow-net` to untrusted code that also has `--deny-net` restrictions you depend on for security.</p> <p><strong>Affected:</strong> crates.io: deno</p> <p>## Summary</p> <p>When a WebSocket connection was opened, Deno checked the destination hostname against `--deny-net` rules but did not re-check the IP addresses that hostname resolved to. An attacker-controlled script could use a specially crafted domain name that passes the hostname check yet resolves to a denied IP, bypassing the network restriction entirely.</p> <p>## Impact</p> <p>Code running under `--deny-net` could connect to hosts that the user intended to block. In practice this means network isolation rules — for example, blocking access to `localhost` or internal services — could be silently circumvented by a malicious or compromised dependency.</p> <p>`Deno.connect` and `fetch()` were not affected by this specific issue (a companion advisory covers `fetch()`).</p> <p>## Who is affected</p> <p>Users who:</p> <p>- run untrusted or third-party code with `deno run`, and - rely on `--deny-net` to restrict which hosts that code can reach.</p> <p>If you do not use `--deny-net`, or if you only run fully trusted code, you are not affected.</p> <p>## Workaround</p> <p>No workaround is available short of upgrading. If upgrading immediately is not possible, avoid granting `--allow-net` to untrusted code that also has `--deny-net` restrictions you depend on for security.</p> https://cve.radiocsirt.org/vuln/ghsa-83pc-3rw9-qpwj