GHSA-67hm-27mx-9cg7

ghsaUSosv

Link Following in Deno

view advisory published 2022-06-13Licence: CC-BY-4.0

Deno <=1.14.0 file sandbox does not handle symbolic links correctly. When running Deno with specific write access, the Deno.symlink method can be used to gain access to any directory.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-41641US	high8.4	0.38% (32nd)	—	2022-06-12
Deno <=1.14.0 file sandbox does not handle symbolic links correctly. When running Deno with specific write access, the Deno.symlink method can be used to gain access to any directo…

references

External citations — patches, advisories, analysis.

https://github.com/denoland/deno/commit/d44011a69e0674acfa9c59bd7ad7f0523eb61d42WEB
https://github.com/denoland/deno/issues/12152WEB
https://github.com/denoland/deno/pull/12554WEB
https://hackers.report/report/614876917a7b150012836bb8WEB
https://nvd.nist.gov/vuln/detail/CVE-2021-41641ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan