crates.io/deno CVE-2024-27933: high 8.2

Deno arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypass

Action: Upgrade deno to 1.39.1 or later.

cargo update -p deno --precise 1.39.1

Affected

Fixed versions

Sources

• osv: GHSA-6q4w-9x56-rmwq
• https://github.com/denoland/deno/security/advisories/GHSA-6q4w-9x56-rmwq
• https://nvd.nist.gov/vuln/detail/CVE-2024-27933
• https://github.com/denoland/deno/commit/55fac9f5ead6d30996400e8597c969b675c5a22b
• https://github.com/denoland/deno/commit/5a91a065b882215dde209baf626247e54c21a392
• https://github.com/denoland/deno
• https://github.com/denoland/deno/blob/v1.39.0/runtime/permissions/prompter.rs#L214
• https://github.com/denoland/deno/blob/v1.39.0/runtime/permissions/prompter.rs#L220
• https://github.com/denoland/deno/blob/v1.39.0/runtime/permissions/prompter.rs#L225
• https://github.com/denoland/deno/blob/v1.39.0/runtime/permissions/prompter.rs#L241
• https://github.com/denoland/deno/blob/v1.39.0/runtime/permissions/prompter.rs#L256
• https://github.com/denoland/deno/blob/v1.39.0/runtime/permissions/prompter.rs#L265
• https://github.com/denoland/deno/blob/v1.39.0/runtime/permissions/prompter.rs#L99

CVE-2024-27933 · published 2024-03-06T17:04:08Z · modified 2026-09-10T03:50:10.304548338Z · JSON