GitHub Advisoryadvisory · crates.io

GHSA-67hm-27mx-9cg7 Link Following in Deno

HIGH Published 2022-06-13 Modified 2022-06-23 Official page ↗
Aliases
CVE-2021-41641
Ecosystem
crates.io
Packages
deno
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Weaknesses
CWE-59
Reviewed
2022-06-23

Affected packages

• crates.io deno: < 1.16.0 → fixed in 1.16.0

Description

Deno <=1.14.0 file sandbox does not handle symbolic links correctly. When running Deno with specific write access, the Deno.symlink method can be used to gain access to any directory.

Related

Alias · CVE (1)

  • CVE-2021-41641 Deno <=1.14.0 file sandbox does not handle symbolic links correctly. vulnerability

Weakness · CWE (1)

  • CWE-59 Improper Link Resolution Before File Access weakness

References