CVE-2022-24783CWE-269

Sandbox bypass leading to arbitrary code execution in Deno

Critical · published March 25, 2022

CVSS v3.1
10.0
EPSS
1%
Percentile
66.5
In the wild
Unconfirmed
What it is

🚨 A crafty piece of code can slip past all permission checks in Deno versions 1.18.0 to 1.20.2, enabling attackers to execute arbitrary shell commands! 🔥 Think of Deno like a high-security hotel; this vulnerability allows a rogue insider to bypass all security measures and access any room without a keycard! 🏨 With this loophole, a malicious actor could potentially wreak havoc—gaining access to sensitive data, manipulating files, or even launching harmful scripts without any restrictions. It's like handing a burglar the master key to your entire building!

Put simply

Think of Deno like a high-security hotel; this vulnerability allows a rogue insider to bypass all security measures and access any room without a keycard! 🏨 This vulnerability allows attackers executing code in the Deno runtime to bypass all permission checks, leading to arbitrary shell code execution. It impacts Deno versions 1.18.0 through 1.20.2, but users of Deno Deploy are safe.

What to do

With this loophole, a malicious actor could potentially wreak havoc—gaining access to sensitive data, manipulating files, or even launching harmful scripts without any restrictions. It's like handing a burglar the master key to your entire building! Immediately upgrade Deno to version 1.20.3 to close this critical vulnerability. There are no workarounds, so swift action is essential! You've got this! Just update, and you'll be securing your Deno environment in no time! 🛡️

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01147 · 66.5th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2022-03-25T21:15Z
EPSS history
Timeline
  • 25 MAR 21:15Z
    Sandbox bypass leading to arbitrary code execution in Deno
    cvelistv5