CVE-2026-49406 Details
Description
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.12, when Deno was run in BYONM mode (nodeModulesDir: "manual"), the module resolver did not validate that a package's resolved entrypoint stayed within its node_modules/<pkg>/ directory. A malicious package.json whose main field contained .. segments was able to resolve to an arbitrary path on disk, and the resolver then read that file without consulting the --allow-read allowlist. This let a require("evil-pkg") call return the contents of a file that a direct Deno.readTextFileSync(...) call would have been blocked from reading. This vulnerability is fixed in 2.7.12.
A vulnerability exists in Deno versions through 2.7.11 when run in BYONM mode (nodeModulesDir: 'manual'). The module resolver failed to validate that a package's main entrypoint remained within its designated node_modules directory. This oversight allowed a malicious package.json to resolve to arbitrary paths on the disk, bypassing the --allow-read permission restrictions. As a result, a require('evil-pkg') call could access the contents of files that would have been blocked by a direct Deno.readTextFileSync() call. The vulnerability is fixed in Deno 2.7.12.
Users should update to Deno version 2.7.12 or later. Those on unpatched versions can avoid BYONM mode for projects with untrusted packages, audit package.json files for traversal segments, or ensure the --allow-read scope covers all visible files.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/denoland/deno/security/advisories/GHSA-968w-xfqw-vp9q | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/denoland/deno/security/advisories/GHSA-968w-xfqw-vp9q | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| deno deno | < 2.7.12 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 23, 2026 | New CVE Received | [email protected] |
| Jun 23, 2026 | CVE Modified | CISA-ADP |