CVE-2023-28446

Deno is a simple, modern and secure runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Arbitrary program names without any ANSI filtering allows any malicious program to clear the first 2 lines of a `op_spawn_child` or `op_kill` prompt and replace it with any desired text. This works with any command on the respective platform, giving the program the full ability to choose what program they wanted to run. This problem can not be exploited on systems that do not attach an interactive prompt (for example headless servers). This issue has been patched in version 1.31.2.

• CWE-150

• https://github.com/denoland/deno/blob/7d13d65468c37022f003bb680dfbddd07ea72173/runtime/js/40_process.js#L175Vendor Advisory
• https://github.com/denoland/deno/releases/tag/v1.31.2Patch, Release Notes
• https://github.com/denoland/deno/security/advisories/GHSA-vq67-rp93-65qfExploit, Vendor Advisory
• https://github.com/denoland/deno/blob/7d13d65468c37022f003bb680dfbddd07ea72173/runtime/js/40_process.js#L175Vendor Advisory
• https://github.com/denoland/deno/releases/tag/v1.31.2Patch, Release Notes
• https://github.com/denoland/deno/security/advisories/GHSA-vq67-rp93-65qfExploit, Vendor Advisory

Published

Mar 24, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-28440Discourse is an open source platform for community discussio…2.7
• CVE-2023-28441smartCARS 3 is flight tracking software. In version 0.5.8 an…7.5
• CVE-2023-28442GeoNode is an open source platform that facilitates the crea…5.3
• CVE-2023-28443Directus is a real-time API and App dashboard for managing S…5.5
• CVE-2023-28444angular-server-side-configuration helps configure an angular…7.5
• CVE-2023-28445Deno is a runtime for JavaScript and TypeScript that uses V8…9.8
• CVE-2023-28447Smarty is a template engine for PHP. In affected versions sm…6.1
• CVE-2023-28448Versionize is a framework for version tolerant serializion/d…7.5
• CVE-2023-2845Improper Access Control in GitHub repository cloudexplorer-d…8.1
• CVE-2023-28450An issue was discovered in Dnsmasq before 2.90. The default …7.5
• CVE-2023-28451An issue was discovered in Technitium 11.0.2. There is a vul…7.5
• CVE-2023-28452An issue was discovered in CoreDNS through 1.10.1. There is …7.5