{"id":"EUVD-2026-38543","enisaUuid":"19ed899b-5ac2-3892-bb36-5028c9947076","description":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, environment access is gated by the env permission. You can deny it with --deny-env, or restrict it to a specific allowlist with --allow-env\u003dFOO,BAR. The expectation is that a program running without env permission cannot change process.env. process.loadEnvFile() (the Node-compatible API for loading variables from a .env file) does not honor this. It only checks that the program has read permission for the dotenv file, then writes every key in that file into the process environment — even when env access is denied. In effect, --allow-read plus a writable or attacker-controlled .env file is enough to defeat --deny-env. This vulnerability is fixed in 2.8.1.","datePublished":"Jun 23, 2026, 5:16:17 PM","dateUpdated":"Jun 23, 2026, 5:54:51 PM","baseScore":5.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","references":"https://github.com/denoland/deno/security/advisories/GHSA-4c8g-jvcx-v4hv\n","aliases":"CVE-2026-49983\nGHSA-4c8g-jvcx-v4hv\n","assigner":"GitHub_M","epss":0.14,"enisaIdProduct":[{"id":"39d9dfbb-0198-359c-ba4d-79ab18a835d5","product":{"name":"deno","vendor":{"name":"denoland"}},"product_version":"\u003c 2.8.1"}],"enisaIdVendor":[{"id":"9c700f85-df16-3698-9cac-ba5f6b0286b6","vendor":{"name":"denoland"}}],"enisaIdVulnerability":[{"id":"981e2b97-0db4-3f80-9a22-9eb2a37742d5","vulnerability":{"id":"CVE-2026-49983","description":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, environment access is gated by the env permission. You can deny it with --deny-env, or restrict it to a specific allowlist with --allow-env\u003dFOO,BAR. The expectation is that a program running without env permission cannot change process.env. process.loadEnvFile() (the Node-compatible API for loading variables from a .env file) does not honor this. It only checks that the program has read permission for the dotenv file, then writes every key in that file into the process environment — even when env access is denied. In effect, --allow-read plus a writable or attacker-controlled .env file is enough to defeat --deny-env. This vulnerability is fixed in 2.8.1.","datePublished":"Jun 23, 2026, 5:16:17 PM","dateUpdated":"Jun 23, 2026, 5:54:51 PM","status":"PUBLISHED","baseScore":5.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","references":"https://github.com/denoland/deno/security/advisories/GHSA-4c8g-jvcx-v4hv\n","enisa_id":"EUVD-2026-38543\n","assigner":"GitHub_M","epss":0.14,"dataProcessed":"Nov 7, 2026, 7:22:47 AM","vulnerabilityProduct":[{"id":"1e24b152-ca93-32d9-829e-34fd773d587a","product":{"name":"deno","vendor":{"name":"denoland"}},"product_version":"\u003c 2.8.1"}],"vulnerabilityVendor":[{"id":"43e2f356-46f6-3bd1-9964-cb8a7ecb3675","vendor":{"name":"denoland"}}]}},{"id":"f225b1e9-fa41-31de-bf01-ac719edd401f","vulnerability":{"id":"GHSA-4c8g-jvcx-v4hv","description":"Deno: process.loadEnvFile() bypasses env permission checks and mutates process.env with only read access","datePublished":"Jun 16, 2026, 7:04:57 PM","dateUpdated":"Jul 20, 2026, 9:01:23 PM","baseScore":0.0,"references":"https://github.com/denoland/deno/security/advisories/GHSA-4c8g-jvcx-v4hv\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-49983\nhttps://github.com/denoland/deno\n","enisa_id":"EUVD-2026-38543\n","aliases":"GHSA-4c8g-jvcx-v4hv\nCVE-2026-49983\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}