CRITICALcrates.io →
Deno arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypass
Deno arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypass
Affected packages
- deno
Exploit signal
- Known exploited (CISA KEV)
- No
- EPSS score
- —
- EPSS percentile
- —
EPSS is the probability a CVE is exploited in the wild; percentile is its rank among all CVEs.
Sources
- https://github.com/denoland/deno/security/advisories/GHSA-6q4w-9x56-rmwq
- https://nvd.nist.gov/vuln/detail/CVE-2024-27933
- https://github.com/denoland/deno/commit/55fac9f5ead6d30996400e8597c969b675c5a22b
- https://github.com/denoland/deno/commit/5a91a065b882215dde209baf626247e54c21a392
- https://github.com/denoland/deno
- https://github.com/denoland/deno/blob/v1.39.0/runtime/permissions/prompter.rs#L214
- https://github.com/denoland/deno/blob/v1.39.0/runtime/permissions/prompter.rs#L220
- https://github.com/denoland/deno/blob/v1.39.0/runtime/permissions/prompter.rs#L225
- https://github.com/denoland/deno/blob/v1.39.0/runtime/permissions/prompter.rs#L241
- https://github.com/denoland/deno/blob/v1.39.0/runtime/permissions/prompter.rs#L256
- https://github.com/denoland/deno/blob/v1.39.0/runtime/permissions/prompter.rs#L265
- https://github.com/denoland/deno/blob/v1.39.0/runtime/permissions/prompter.rs#L99
Structured record: https://osv.dev/vulnerability/GHSA-6q4w-9x56-rmwq
Recommended response stack
Some links are affiliate links — HackTribune may earn a commission at no extra cost to you.
Get incidents like this as alerts for your stack.
Join the beta