What’s Vulnerable › Vulnerabilities

CVE-2022-24783: Sandbox bypass leading to arbitrary code execution in Deno

• Severity: critical (CVSS 10.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-03-25 · updated 2026-06-17
• Weakness: CWE-269

Description

Deno is a runtime for JavaScript and TypeScript. The versions of Deno between release 1.18.0 and 1.20.2 (inclusive) are vulnerable to an attack where a malicious actor controlling the code executed in a Deno runtime could bypass all permission checks and execute arbitrary shell code. This vulnerability does not affect users of Deno Deploy. The vulnerability has been patched in Deno 1.20.3. There is no workaround. All users are recommended to upgrade to 1.20.3 immediately.

Affected products

• denoland deno: from 1.18.0 before 1.20.3 — fixed in 1.20.3

How to fix

Upgrade to a fixed version: denoland deno 1.20.3. Check the vendor advisory for mitigations.

References

• https://github.com/denoland/deno/security/advisories/GHSA-838h-jqp6-cf2f
• https://github.com/denoland/deno/security/advisories/GHSA-838h-jqp6-cf2f

Get alerted when CVE-2022-24783 or the next vulnerability affects your stack