Arbitrary Code Execution Vulnerability in Deno Runtime

CVE-2024-27934

What is CVE-2024-27934?

The Deno runtime, which supports JavaScript, TypeScript, and WebAssembly, has been identified to contain a significant vulnerability stemming from the usage of inherently unsafe *const c_void and ExternalPointer components. This flaw allows an attacker, controlling the executed code within a Deno environment, to exploit use-after-free conditions, leading to arbitrary code execution on the host system. Versions affected include those starting at 1.36.2 and preceding 1.40.3. The vulnerability presents serious security implications, as it can be exploited regardless of the permissions set on the Deno runtime. This issue was addressed in version 1.40.3, highlighting the critical importance of using updated software to safeguard against potential exploits.

References