CVE-2024-27931: deno Improper Input Validation

Vulnerability summary

CVE-2024-27931 is a medium (CVSS 6.5) Improper Input Validation vulnerability in deno. EPSS estimates a 0.49% chance of exploitation in the next 30 days, higher than 40.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 05-03-2024
   PublishedVulnerability first disclosed.
2. 02-08-2024
   Last modifiedVulnerability information updated.

Description

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. Insufficient validation of parameters in `Deno.makeTemp*` APIs would allow for creation of files outside of the allowed directories. This may allow the user to overwrite important files on the system that may affect other systems. A user may provide a prefix or suffix to a `Deno.makeTemp*` API containing path traversal characters. This is fixed in Deno 1.41.1.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.