CVE-2024-27936

Summary

CVE-2024-27936 is a vulnerability affecting Deno, a JavaScript, TypeScript, and WebAssembly runtime, between versions 1.32.1 and 1.41.0. Maliciously crafted permission requests can bypass Deno's security by inserting a broken ANSI escape sequence, which spoofs the permission prompt content. Although Deno removes ANSI escape sequences from the prompt, it incorrectly uses the original request during permission granting. This flaw enables a malicious Deno program to deceive users by displaying falsified file paths or program names. Version 1.41.0 of the deno library has been released with a patch to address this issue.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.