SB2024030586 - Improper Neutralization of Escape, Meta, or Control Sequences in Deno

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2024030586

SB2024030586 - Improper Neutralization of Escape, Meta, or Control Sequences in Deno

Published: March 5, 2024 Updated: April 23, 2026

Security Bulletin ID SB2024030586
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Improper Neutralization of Escape, Meta, or Control Sequences (CVE-ID: CVE-2024-27936)

The vulnerability allows a remote user to spoof the interactive permission prompt.

The vulnerability exists due to improper neutralization of escape sequences in the permission prompt handling when processing crafted permission requests. A remote user can insert a broken ANSI escape sequence into request contents to spoof the interactive permission prompt.

This can cause the prompt to display a different file path or program name than the permission actually granted, and user interaction is required to approve the request.


Remediation

Install update from vendor's website.

References