~ / search / GHSA-67hm-27mx-9cg7

GHSA-67hm-27mx-9cg7

Link Following in Deno

Source: GitHub Advisory Database (reviewed) High CVE-2021-41641

Packages

EcosystemPackageAffectedFixed in
crates.io deno < 1.16.0 1.16.0

Details

As written in the advisory (Markdown source, shown as plain text).

Deno <=1.14.0 file sandbox does not handle symbolic links correctly. When running Deno with specific write access, the Deno.symlink method can be used to gain access to any directory.

References

External links from the advisory. They lead to third-party sites.