Описание
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions prior to 2.5.3 and 2.2.15 are vulnerable to Command Line Injection attacks on Windows when batch files are executed. In Windows, CreateProcess() always implicitly spawns cmd.exe if a batch file (.bat, .cmd, etc.) is being executed even if the application does not specify it via the command line. This makes Deno vulnerable to a command injection attack on Windows. Versions 2.5.3 and 2.2.15 fix the issue.
Ссылки
- Patch
- Issue TrackingPatch
- Release Notes
- Release Notes
- ExploitVendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 2.2.15 (включая)Версия от 2.3.0 (включая) до 2.5.3 (исключая)
Одновременно
Одно из
cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:*
cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
EPSS
Процентиль: 35%
0.00146
Низкий
8.1 High
CVSS3
Дефекты
CWE-77
Связанные уязвимости
CVSS3: 8.1
github
4 месяца назад
Deno is Vulnerable to Command Injection on Windows During Batch File Execution
EPSS
Процентиль: 35%
0.00146
Низкий
8.1 High
CVSS3
Дефекты
CWE-77