Environment Access Issue in Deno Runtime by Deno Land
CVE-2026-49983

5.2MEDIUM

Key Information:

Vendor

Denoland

Status
Deno
Vendor
CVE Published:
23 June 2026

What is CVE-2026-49983?

Deno, a JavaScript and TypeScript runtime, has a significant vulnerability regarding environment access before version 2.8.1. Users could control environment variables despite restrictions placed using the --deny-env flag. Even when denied permission, the method process.loadEnvFile() improperly respects these checks, leading to potential leakage of sensitive environment data from .env files. This flaw can be exploited by an attacker who has read access to a .env file, thus circumventing defined restrictions. Deno version 2.8.1 addresses this issue, ensuring that environment controls are adequately enforced.

Affected Version(s)

deno < 2.8.1

References

https://github.com/denoland/deno/security/advisories/GHSA...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.2
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.