by Kastro
Paper/Archive/CVE-2022-24783

CVE-2022-24783

denoland deno — Sandbox bypass leading to arbitrary code execution in Deno

EPSS 1%CVSS 10.0
critical.is priorityof 100
43
CVSS 10.0 (NVD, CNA agree)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 66.8.668 × 2013.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Deno is a runtime for JavaScript and TypeScript. The versions of Deno between release 1.18.0 and 1.20.2 (inclusive) are vulnerable to an attack where a malicious actor controlling the code executed in a Deno runtime could bypass all permission checks and execute arbitrary shell code. This vulnerability does not affect users of Deno Deploy. The vulnerability has been patched in Deno 1.20.3. There is no workaround. All users are recommended to upgrade to 1.20.3 immediately.

Affected

ProductAffectedFixed inSource
deno>= 1.18.0, < 1.20.3–CNA

Scores by source

GitHub_M (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/denoland/deno/security/advisories/GHSA-838h-jqp6-cf2f