CVE-2024-27932: deno — Katalog CVE

csirt@kutim:~/threat-intel/cve/CVE-2024-27932

CVSS 4.6 · Medium EPSS 0,59%

Kerentanan Improper Input Validation pada deno. Skor CVSS 3.1 4.6 (Medium) menurut NVD.

Deskripsi (NVD)

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.8.0 and prior to version 1.40.4, Deno improperly checks that an import specifier's hostname is equal to or a child of a token's hostname, which can cause tokens to be sent to servers they shouldn't be sent to. An auth token intended for `example[.]com` may be sent to `notexample[.]com`. Anyone who uses DENO_AUTH_TOKENS and imports potentially untrusted code is affected. Version 1.40.0 contains a patch for this issue

Rincian

Terbit di NVD: 21 Maret 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 4.6 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-20: Improper Input Validation
EPSS (30 hari): 0,59% peluang dieksploitasi; lebih tinggi dari 46,9% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
deno	deno	Versi 1.8.0 hingga sebelum 1.40.4

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/denoland/deno/security/advisories/GHSA-5frw-4rwq-xhcr exploit · advisory vendor
https://github.com/denoland/deno/commit/de23e3b60b066481cc390f459497d5bef42a899b patch
https://github.com/denoland/deno/blob/3f4639c330a31741b0efda2f93ebbb833f4f95bc/cli/auth_tokens.rs#L89 product

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.