Executive brief
Deno is a software runtime used to execute JavaScript and TypeScript applications. A security flaw in how Deno handles certain manual package configurations allows a malicious package to bypass security restrictions and read sensitive files on the host system that it should not have access to. This could lead to the exposure of private data, such as configuration files or credentials, if a developer uses a compromised or untrusted third-party library.
Technical details
A path traversal vulnerability exists in Deno's 'Bring Your Own Node Modules' (BYONM) mode, specifically when 'nodeModulesDir' is set to 'manual'. The module resolver fails to validate that a package's entrypoint, defined in the 'main' field of package.json, remains within the package's directory. By using dot-dot (..) sequences, a malicious package can point its entrypoint to sensitive files elsewhere on the disk (e.g., .env files or credentials). Because the BYONM resolver bypasses the standard '--allow-read' permission checks for paths containing 'node_modules', it can read and return the contents of these files to the application. This vulnerability is fixed in version 2.7.12.
Affected products
- denoland Deno < 2.7.12
Timeline
- 2026-05-27: advisory: GitHub advisory published by maintainers
- 2026-06-23: disclosed: NVD publication date
- 2026-06-23: patched: Fix confirmed in version 2.7.12