{"action":"Upgrade deno to 2.7.12 or later.","affected":[{"fixed":"2.7.12","introduced":"0"}],"component":"deno","cve_ids":["CVE-2026-49406"],"ecosystem":"deno","exploited":false,"fixed_versions":["2.7.12"],"ghsa_id":"GHSA-968w-xfqw-vp9q","id":"tcs_01M5K4YW8W4V36R23AMNWMJ7JV","modified_at":"2026-05-30T04:02:31Z","published_at":"2026-05-27T13:09:16Z","references":["https://github.com/denoland/deno/security/advisories/GHSA-968w-xfqw-vp9q","https://www.cve.org/CVERecord?id=CVE-2026-49406"],"severity":{"label":"medium","score":5.5},"sources":[{"source":"deno-runtime","source_id":"GHSA-968w-xfqw-vp9q","url":"https://github.com/denoland/deno/security/advisories/GHSA-968w-xfqw-vp9q"}],"summary":"BYONM module resolution allows `package.json` main path traversal to bypass `--allow-read` restrictions"}