deno/deno CVE-2026-49406: medium 5.5

BYONM module resolution allows `package.json` main path traversal to bypass `--allow-read` restrictions

Action: Upgrade deno to 2.7.12 or later.

Affected

Fixed versions

Sources

• deno-runtime: GHSA-968w-xfqw-vp9q
• https://www.cve.org/CVERecord?id=CVE-2026-49406

CVE-2026-49406 · published 2026-05-27T13:09:16Z · modified 2026-05-30T04:02:31Z · JSON