CVE-2026-49406: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in denoland deno
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.12, when Deno was run in BYONM mode (nodeModulesDir: "manual"), the module resolver did not validate that a package's resolved entrypoint stayed within its node_modules/<pkg>/ directory. A malicious package.json whose main field contained .. segments was able to resolve to an arbitrary path on disk, and the resolver then read that file without consulting the --allow-read allowlist. This let a require("evil-pkg") call return the contents of a file that a direct Deno.readTextFileSync(...) call would have been blocked from reading. This vulnerability is fixed in 2.7.12.
AI Analysis
Technical Summary
CVE-2026-49406 is a path traversal vulnerability (CWE-22) in the Deno runtime before version 2.7.12. When Deno is run in BYONM mode with nodeModulesDir configured as "manual", the module resolver fails to validate that the resolved entrypoint of a package remains within its node_modules/<pkg>/ directory. A malicious package.json with '..' segments in its main field can cause the resolver to access arbitrary files on disk, bypassing the --allow-read permission allowlist. This results in require("evil-pkg") returning contents of files that would otherwise be inaccessible. The issue is resolved in Deno 2.7.12.
Potential Impact
An attacker can craft a malicious package that, when required, causes Deno to read arbitrary files on the filesystem without the necessary read permissions. This leads to unauthorized disclosure of file contents, potentially exposing sensitive data. The vulnerability does not allow code execution or modification, but it compromises confidentiality.
Mitigation Recommendations
Upgrade Deno to version 2.7.12 or later, where this path traversal vulnerability is fixed. No other mitigations are indicated or required.
CVE-2026-49406: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in denoland deno
Description
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.12, when Deno was run in BYONM mode (nodeModulesDir: "manual"), the module resolver did not validate that a package's resolved entrypoint stayed within its node_modules/<pkg>/ directory. A malicious package.json whose main field contained .. segments was able to resolve to an arbitrary path on disk, and the resolver then read that file without consulting the --allow-read allowlist. This let a require("evil-pkg") call return the contents of a file that a direct Deno.readTextFileSync(...) call would have been blocked from reading. This vulnerability is fixed in 2.7.12.
CVSS v3.1
Score 5.5medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-49406 is a path traversal vulnerability (CWE-22) in the Deno runtime before version 2.7.12. When Deno is run in BYONM mode with nodeModulesDir configured as "manual", the module resolver fails to validate that the resolved entrypoint of a package remains within its node_modules/<pkg>/ directory. A malicious package.json with '..' segments in its main field can cause the resolver to access arbitrary files on disk, bypassing the --allow-read permission allowlist. This results in require("evil-pkg") returning contents of files that would otherwise be inaccessible. The issue is resolved in Deno 2.7.12.
Potential Impact
An attacker can craft a malicious package that, when required, causes Deno to read arbitrary files on the filesystem without the necessary read permissions. This leads to unauthorized disclosure of file contents, potentially exposing sensitive data. The vulnerability does not allow code execution or modification, but it compromises confidentiality.
Mitigation Recommendations
Upgrade Deno to version 2.7.12 or later, where this path traversal vulnerability is fixed. No other mitigations are indicated or required.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-29T19:08:01.257Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a3ac4efeed863c81e618234
Added to database: 06/23/2026, 17:39:59 UTC
Last enriched: 06/23/2026, 17:55:23 UTC
Last updated: 08/04/2026, 12:46:13 UTC
Views: 65
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.