CVE-2024-27931 Insufficient permission checking in `Deno.makeTemp*` APIs

What is CVE-2024-27931?

CVE-2024-27931 is a medium-severity path traversal vulnerability in denoland deno, published on 5 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. Insufficient validation of parameters in `Deno.makeTemp*` APIs would allow for creation of files outside of the allowed directories. This may allow the user to overwrite important files on the system that may affect other systems. A user may provide a prefix or suffix to a `Deno.makeTemp*` API containing path traversal characters. This is fixed in Deno 1.41.1.

Weakness: CWE-20

Which versions are affected by CVE-2024-27931?

2 open source packages ship an affected version, including deno. It affects 1 product.

Products include Deno Deno.

How do I fix CVE-2024-27931?

Upgrade deno to 1.41.1 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2024-27931 being exploited?

There is no known exploitation of CVE-2024-27931 in the wild and no public exploit code.

Other vulnerabilities in denoland deno

• CVE-2023-28445 Deno improperly handles resizable ArrayBuffer Critical 10.0
• CVE-2022-24783 Sandbox bypass leading to arbitrary code execution in Deno Critical 10.0
• CVE-2021-32619 Static imports inside dynamically imported modules do not adhere to permission checks Critical 9.8
• CVE-2026-22863 Deno node:crypto doesn't finalize cipher Critical 9.2
• CVE-2024-27936 Deno interactive permission prompt spoofing via improper ANSI stripping High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-hrqr-jv8w-v9jh, JLSEC-2026-103.