Improper Neutralization of Escape, Meta, or Control Sequences in Deno - CVE-2023-22499

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU127026

Improper Neutralization of Escape, Meta, or Control Sequences in Deno - CVE-2023-22499

Published: January 17, 2023 / Updated: April 23, 2026


Vulnerability identifier: #VU127026
CSH Severity: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2023-22499
CWE-ID: CWE-150
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
Deno
Software vendor:
Deno Land

Description

The vulnerability allows a remote attacker to spoof an interactive permission prompt.

The vulnerability exists due to improper neutralization of terminal output in the interactive permission prompt when handling multithreaded program output. A remote attacker can clear the terminal screen and rewrite the displayed prompt to spoof an interactive permission prompt.

User interaction is required, and the issue affects environments that attach an interactive prompt, including programs using the Web Worker API.


Remediation

Install security update from vendor's website.

External links