https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 04:48:49 +0000 https://cve.radiocsirt.org/vuln/cve-2026-49406 <p><strong>Affected:</strong> denoland deno</p> <p>Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.12, when Deno was run in BYONM mode (nodeModulesDir: &#34;manual&#34;), the module resolver did not validate that a package&#39;s resolved entrypoint stayed within its node_modules/&lt;pkg&gt;/ directory. A malicious package.json whose main field contained .. segments was able to resolve to an arbitrary path on disk, and the resolver then read that file without consulting the --allow-read allowlist. This let a require(&#34;evil-pkg&#34;) call return the contents of a file that a direct Deno.readTextFileSync(...) call would have been blocked from reading. This vulnerability is fixed in 2.7.12.</p> <p><strong>Affected:</strong> denoland deno</p> <p>Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.12, when Deno was run in BYONM mode (nodeModulesDir: &#34;manual&#34;), the module resolver did not validate that a package&#39;s resolved entrypoint stayed within its node_modules/&lt;pkg&gt;/ directory. A malicious package.json whose main field contained .. segments was able to resolve to an arbitrary path on disk, and the resolver then read that file without consulting the --allow-read allowlist. This let a require(&#34;evil-pkg&#34;) call return the contents of a file that a direct Deno.readTextFileSync(...) call would have been blocked from reading. This vulnerability is fixed in 2.7.12.</p> https://cve.radiocsirt.org/vuln/cve-2026-49406