CVE-2024-27936

Summary

CVE-2024-27936 is a vulnerability affecting Deno, a JavaScript, TypeScript, and WebAssembly runtime, between versions 1.32.1 and 1.41.0. Maliciously crafted permission requests can exploit Deno's handling of ANSI escape sequences by inserting broken codes into the request contents. Though Deno removes these sequences from the displayed prompt, the permissions are granted based on the original, sequence-containing content. Consequently, a malicious Deno program can spoof the content of the interactive permission prompt, misrepresenting file paths or program names to users. Version 1.41.0 of the deno library includes a patch to mitigate this issue.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.