{"id":"EUVD-2026-38545","enisaUuid":"ed07cf58-23cf-3804-879a-b7bb03b46d61","description":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.12, when Deno was run in BYONM mode (nodeModulesDir: \"manual\"), the module resolver did not validate that a package\u0027s resolved entrypoint stayed within its node_modules/\u003cpkg\u003e/ directory. A malicious package.json whose main field contained .. segments was able to resolve to an arbitrary path on disk, and the resolver then read that file without consulting the --allow-read allowlist. This let a require(\"evil-pkg\") call return the contents of a file that a direct Deno.readTextFileSync(...) call would have been blocked from reading. This vulnerability is fixed in 2.7.12.","datePublished":"Jun 23, 2026, 5:19:15 PM","dateUpdated":"Jun 23, 2026, 5:50:19 PM","baseScore":5.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/denoland/deno/security/advisories/GHSA-968w-xfqw-vp9q\n","aliases":"CVE-2026-49406\nGHSA-968w-xfqw-vp9q\n","assigner":"GitHub_M","epss":0.18,"enisaIdProduct":[{"id":"7979bf43-ff0c-363f-aa71-f65b68a3ccad","product":{"name":"deno","vendor":{"name":"denoland"}},"product_version":"\u003c 2.7.12"}],"enisaIdVendor":[{"id":"fcbea3cf-9e95-3046-ae32-eeba7bcbdf65","vendor":{"name":"denoland"}}],"enisaIdVulnerability":[{"id":"56039d30-b6dd-3c96-976c-8315f84af8d6","vulnerability":{"id":"GHSA-968w-xfqw-vp9q","description":"Deno: BYONM module resolution allows `package.json` main path traversal to bypass `--allow-read` restrictions","datePublished":"Jun 16, 2026, 7:11:26 PM","dateUpdated":"Jul 20, 2026, 1:43:23 PM","baseScore":0.0,"references":"https://github.com/denoland/deno/security/advisories/GHSA-968w-xfqw-vp9q\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-49406\nhttps://github.com/denoland/deno\n","enisa_id":"EUVD-2026-38545\n","aliases":"GHSA-968w-xfqw-vp9q\nCVE-2026-49406\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"5a411059-4710-3c36-a15e-3e8808a37b8a","vulnerability":{"id":"CVE-2026-49406","description":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.12, when Deno was run in BYONM mode (nodeModulesDir: \"manual\"), the module resolver did not validate that a package\u0027s resolved entrypoint stayed within its node_modules/\u003cpkg\u003e/ directory. A malicious package.json whose main field contained .. segments was able to resolve to an arbitrary path on disk, and the resolver then read that file without consulting the --allow-read allowlist. This let a require(\"evil-pkg\") call return the contents of a file that a direct Deno.readTextFileSync(...) call would have been blocked from reading. This vulnerability is fixed in 2.7.12.","datePublished":"Jun 23, 2026, 5:19:15 PM","dateUpdated":"Jun 23, 2026, 5:50:19 PM","status":"PUBLISHED","baseScore":5.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/denoland/deno/security/advisories/GHSA-968w-xfqw-vp9q\n","enisa_id":"EUVD-2026-38545\n","assigner":"GitHub_M","epss":0.18,"dataProcessed":"Nov 7, 2026, 7:22:41 AM","vulnerabilityProduct":[{"id":"8821e4d8-7aac-3073-a31f-dbdcd1b39f6b","product":{"name":"deno","vendor":{"name":"denoland"}},"product_version":"\u003c 2.7.12"}],"vulnerabilityVendor":[{"id":"e09bb410-414e-3b5a-b07d-7cd21fe4c1ed","vendor":{"name":"denoland"}}]}}],"enisaIdAdvisory":[]}