Deno runtime vulnerable to spoofed permission prompts

CVE-2024-27936

What is CVE-2024-27936?

The Deno library, a runtime for JavaScript, TypeScript, and WebAssembly, has a vulnerability that allows malicious actors to manipulate the interactive permission prompt using crafted requests. By inserting broken ANSI escape sequences into these requests, attackers can present misleading information to users, such as inaccurate file paths or program names. Although Deno attempts to strip these escape sequences from the prompt, the permissions granted remain based on the original content, which can be exploited. The vulnerability is addressed in version 1.41.0, which includes a crucial patch to enhance security against such spoofing attempts.

References