Exposição de Deno

Web servers
26
score de exposição
44
sites usam
0
em exploração
4
críticos
Análise Vexday

Com 39 CVEs catalogadas e nenhuma em exploração ativa confirmada pelo CISA KEV, o Deno apresenta taxa de exploração abaixo da média geral do catálogo, o que sugere um perfil de risco operacional relativamente contido no momento. No entanto, o surgimento de 10 vulnerabilidades nos últimos 90 dias indica ritmo de descoberta recente que merece acompanhamento próximo. O tipo de falha mais recorrente é CWE-863 (verificação incorreta de autorização), um padrão que pode ter implicações sérias em ambientes onde controle de acesso granular é crítico. A CVE mais perigosa identificada atualmente, CVE-2024-27933, possui EPSS de 0,0228, acompanhada de 4 vulnerabilidades de severidade crítica no total — conjunto que recomenda priorização de atualizações mesmo diante da ausência de exploração ativa documentada.

CVEs

39 resultados
CVE-2024-27933HIGHDeno arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypassEPSS 2.3%CVE-2026-27190HIGHDeno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_processEPSS 2.2%CVE-2025-61787HIGHDeno is Vulnerable to Command Injection on Windows During Batch File ExecutionEPSS 2.1%CVE-2026-32260HIGHCommand Injection via incomplete shell metacharacter blocklist in node:child_process (bypass of CVE-2026-27190 fix)EPSS 1.5%CVE-2023-26103MEDIUMVersions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket functiEPSS 1.2%CVE-2023-28446HIGHDeno is vulnerable to interactive `run` permission prompt spoofing via improper ANSI neutralizationEPSS 1.1%CVE-2022-24783CRITICALSandbox bypass leading to arbitrary code execution in DenoEPSS 1.1%CVE-2021-32619CRITICALStatic imports inside dynamically imported modules do not adhere to permission checksEPSS 1.1%CVE-2023-28445CRITICALDeno improperly handles resizable ArrayBufferEPSS 1.0%CVE-2024-27936HIGHDeno interactive permission prompt spoofing via improper ANSI strippingEPSS 0.9%CVE-2024-27935HIGHDeno's Node.js Compatibility Runtime has Cross-Session Data ContaminationEPSS 0.7%CVE-2023-33966HIGHDeno missing "--allow-net" permission check for built-in Node modulesEPSS 0.6%CVE-2026-22864HIGHDeno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypassEPSS 0.6%CVE-2023-22499HIGHInteractive permission prompt spoofing in DenoEPSS 0.6%CVE-2024-27932MEDIUMDeno's improper suffix match testing for DENO_AUTH_TOKENSEPSS 0.6%CVE-2025-21620HIGHDeno's authorization headers not dropped when redirecting cross-originEPSS 0.5%CVE-2024-27931MEDIUMInsufficient permission checking in `Deno.makeTemp*` APIsEPSS 0.5%CVE-2024-37150HIGHPrivate npm registry support used scope auth token for downloading tarballsEPSS 0.4%CVE-2025-48935MEDIUMDeno has --allow-read / --allow-write permission bypass in `node:sqlite`EPSS 0.4%CVE-2024-27934HIGH*const c_void / ExternalPointer unsoundness leading to use-after-freeEPSS 0.4%