Vulnerability in Deno
CVE-2023-28446
Deno is a simple, modern and secure runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Arbitrary program names without any ANSI filtering allows any malicious program to clear the first 2 lines of a `op_spawn_child` or `op_kill` prompt and replace it with any desired text. This works with any command on the respective platform, giving the program the full ability to choose what program they wanted to run. This problem can not be exploited on systems that do not attach an interactive prompt (for example headless servers). This issue has been patched in version 1.31.2.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.011 (65.1th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 65th percentile — 65.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.011 · newest: 0.011 · change: -0.000
Affected products
- Deno
- Denoland Deno — versions >= 1.8.0, < 1.31.2
Weakness classification (CWE)
References
- github.com/denoland/deno/security/advisories/GHSA-vq67-rp93-65qf (Exploit, Vendor Advisory)
- github.com/denoland/deno/blob/7d13d65468c37022f003bb680dfbddd07ea72173/runtime/… (Vendor Advisory)
- github.com/denoland/deno/releases/tag/v1.31.2 (Patch, Release Notes)
Frequently asked questions
- What is CVE-2023-28446?
- CVE-2023-28446 is a high-severity vulnerability in Deno, classified under CWE-150. CVSS score: 8.8/10. Published 2023-03-24.
- How severe is CVE-2023-28446?
- High severity. CVSS v3 base score is 8.8 out of 10.