CVE-2024-32477: Race condition when flushing input stream leads to permission prompt bypass

Severity: high (CVSS 7.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-04-18 · updated 2026-06-17
Weakness: CWE-78

Description

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. By using ANSI escape sequences and a race between `libc::tcflush(0, libc::TCIFLUSH)` and reading standard input, it's possible to manipulate the permission prompt and force it to allow an unsafe action regardless of the user input. Some ANSI escape sequences act as a info request to the master terminal emulator and the terminal emulator sends back the reply in the PTY channel. standard streams also use this channel to send and get data. For example the `\033[6n` sequence requests the current cursor position. These sequences allow us to append data to the standard input of Deno. This vulnerability allows an attacker to bypass Deno permission policy. This vulnerability is fixed in 1.42.2.

Affected products

denoland deno: before 1.42.2 — fixed in 1.42.2

How to fix

Upgrade to a fixed version: denoland deno 1.42.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-32477 or the next vulnerability affects your stack