crates.io/deno_runtime CVE-2023-28446: high 8.8
Interactive `run` permission prompt spoofing via improper ANSI neutralization
Action: Upgrade deno_runtime to 1.31.2 or later.
cargo update -p deno_runtime --precise 1.31.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.8.0 | 1.31.2 | - |
Fixed versions
| 1.31.2 |
Sources
- osv: GHSA-vq67-rp93-65qf
- https://github.com/denoland/deno/security/advisories/GHSA-vq67-rp93-65qf
- https://nvd.nist.gov/vuln/detail/CVE-2023-28446
- https://github.com/denoland/deno
- https://github.com/denoland/deno/blob/7d13d65468c37022f003bb680dfbddd07ea72173/runtime/js/40_process.js#L175
- https://github.com/denoland/deno/releases/tag/v1.31.2
CVE-2023-28446 · published · modified · JSON