CVE-2024-37150

mediumpriority · track · 26EPSS 0.004 · 36 %ileEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.42% (36th) EPSS

CVSS 6.5 · medium

Is it mine?

2 products

Check your exposure

Who says so?

3 sources

cnnvd · enisa_euvd · nvd

EPSS · scored 2026-10-27

An issue in `.npmrc` support in Deno 1.44.0 was discovered where Deno would send `.npmrc` credentials for the scope to the tarball URL when the registry provided URLs for a tarball on a different domain. All users relying on .npmrc are potentially affected by this vulnerability if their private registry references tarball URLs at a different domain. This includes usage of deno install subcommand, auto-install for npm: specifiers and LSP usage. It is recommended to upgrade to Deno 1.44.1 and if your private registry ever serves tarballs at a different domain to rotate your registry credentials.

cvss

Technical severity, 0–10. One row per scoring source.

7.6

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6–7.6

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:Nprimary · NVD / NIST USexploitability 2.8 · impact 3.6

v3.17.6highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:Lsecondary · ENISA EU

v3.17.6highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:Lsecondary · security-advisories@github.comexploitability 2.8 · impact 4.7

v3.16mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-706USprimaryCWE-200US

affected products (2)

Products and version ranges known to be affected.

denoland deno≤ = 1.44.0enisa_euvdEU
deno deno= 1.44.0nvdUScpe:2.3:a:deno:deno:*:*:*:*:*:*:*:*

also known as (2)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd nvd NVD CVE.org MITRE

published 2024-06-06modified 2026-06-17

related (190)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2025-24813US	critical9.8OT critical	99.9% (100th)	KEV	2025-03-10
Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Defau…
CVE-2021-40539US	critical9.8OT critical	99.0% (100th)	KEV	2021-09-07
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.
CVE-2020-15505US	critical9.8OT critical	99.7% (100th)	KEV	2020-07-07
A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0; and Sen…
CVE-2021-40856US	high7.5	50.1% (99th)	—	2021-12-13
Auerswald COMfortel 1400 IP and 2600 IP before 2.8G devices allow Authentication Bypass via the /about/../ substring.
CVE-2019-0571US	high7.8	15.8% (97th)	Exploit	2019-01-08
An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data Sharing Service Elevation of Privilege Vu…

+185 more

references (11)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan