products / deno

Deno

Deno is a secure-by-default runtime for TypeScript and JavaScript, built on Rust and V8. It ships with a permission model for network, filesystem, and subprocess access. NVD tracks it under cpe:2.3:a:deno:deno with clean semver ranges. Critical CVEs in this product usually mean a sandbox boundary failed.

api usage

Querying Deno

product slugdeno

version format1.20.2, 2.2.0, 1.41.1

bash

curl "https://api.attestd.io/v1/check?product=deno&version=1.20.2" \
  -H "Authorization: Bearer $ATTESTD_KEY"

Deno 1.20.2 is the last vulnerable release for CVE-2022-24783 (fixed in 1.20.3). Malicious Deno code bypasses all permission checks and executes arbitrary shell commands, which drives risk_state: "critical".

json

{
  "product": "deno",
  "version": "1.20.2",
  "supported": true,
  "risk_state": "high",
  "risk_factors": [
    "remote_code_execution",
    "no_authentication_required",
    "internet_exposed_service",
    "patch_available"
  ],
  "actively_exploited": false,
  "remote_exploitable": true,
  "authentication_required": false,
  "patch_available": true,
  "fixed_version": null,
  "confidence": 0.5,
  "cve_ids": [
    "CVE-2022-24783",
    "CVE-2023-22499",
    "CVE-2023-26103",
    "CVE-2023-28446",
    "CVE-2024-27931",
    "CVE-2024-27932",
    "CVE-2024-32477",
    "CVE-2024-34346",
    "CVE-2025-48934",
    "CVE-2025-61785",
    "CVE-2025-61786",
    "CVE-2025-61787",
    "CVE-2026-22863",
    "CVE-2026-22864",
    "CVE-2026-27190",
    "CVE-2026-49401",
    "CVE-2026-49402",
    "CVE-2026-49406",
    "CVE-2026-49440",
    "CVE-2026-49859",
    "CVE-2026-49860",
    "CVE-2026-55517",
    "CVE-2026-66036"
  ],
  "cves": null,
  "max_epss": 0.02213,
  "last_updated": "2026-08-16T11:18:08.825063Z",
  "supply_chain": {
    "compromised": false,
    "sources": [],
    "malware_type": null,
    "description": null,
    "advisory_url": null,
    "compromised_at": null,
    "removed_at": null,
    "source_published_at": null,
    "observed_at": null,
    "ingested_at": null,
    "first_served_at": null,
    "provenance": false
  },
  "supply_chain_monitored": true,
  "typosquat": null
}

safe version

Deno 2.2.0 is past the 1.41.1 path-traversal fix and the earlier permission-bypass and prompt-injection ranges listed below.

bash

curl "https://api.attestd.io/v1/check?product=deno&version=2.2.0" \
  -H "Authorization: Bearer $ATTESTD_KEY"

notable cves

CVE history

Deno CVEs concentrate on the permission model: full sandbox escape, Node compatibility HTTP that skips --allow-net, interactive prompt spoofing, and temp-path traversal. The CVE count is smaller than Node.js, but several entries score critical because they defeat the default-deny design.

CVE	Description	Affects	CVSS
`CVE-2022-24783`	Malicious Deno code bypasses all permission checks and executes arbitrary shell commands.	1.18.0–1.20.2	10.0
`CVE-2023-33966`	Outbound HTTP via built-in node:http/https skips --allow-net.	1.34.0 only	9.8
`CVE-2023-28446`	Unfiltered ANSI in spawn/kill prompts tricks interactive users into approving attacker-chosen programs.	<1.31.2	8.8
`CVE-2024-27931`	Path traversal in Deno.makeTemp* prefix/suffix creates files outside allowed directories.	<1.41.1	6.5

KEV = CISA Known Exploited Vulnerabilities catalog. Active exploitation confirmed.

data sources

Single CPE namespace

NVD publishes Deno runtime CVEs under one CPE product identifier:

cpe:2.3:a:deno:denoRuntime and permission-model CVEs

Attestd matches the deno product slug against this namespace and returns aggregated risk for the requested semver.

All products Node.js Hermes Quickstart