CVE-2024-32468

Deno is a runtime for JavaScript and TypeScript written in rust. Several cross-site scripting vulnerabilities existed in the `deno_doc` crate which lead to Self-XSS with deno doc --html. 1.) XSS in generated `search_index.js`, `deno_doc` outputs a JavaScript file for searching. However, the generated file used `innerHTML` on unsanitzed HTML input. 2.) XSS via property, method and enum names, `deno_doc` did not sanitize property names, method names and enum names. The first XSS most likely didn't have an impact since `deno doc --html` is expected to be used locally with own packages.

• CWE-79

• https://github.com/denoland/deno/security/advisories/GHSA-qqwr-j9mm-fhw6
• https://github.com/denoland/deno_doc/blob/dc556c848831d7ae48f3eff2ababc6e75eb6b73e/src/html/templates/pages/search.js#L120-L144

Published

Nov 25, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-32462Flatpak is a system for building, distributing, and running …8.4
• CVE-2024-32463phlex is an open source framework for building object-orient…7.1
• CVE-2024-32464Action Text brings rich text content and editing to Rails. I…6.1
• CVE-2024-32465Git is a revision control system. The Git project recommends…7.8
• CVE-2024-32466Tolgee is an open-source localization platform. For the `/v2…4.3
• CVE-2024-32467MeterSphere is an open source continuous testing platform. P…6.5
• CVE-2024-32469Decidim is a participatory democracy framework. The paginati…7.1
• CVE-2024-3247In Xpdf 4.05 (and earlier), a PDF object loop in an object s…5.5
• CVE-2024-32470Tolgee is an open-source localization platform. When API key…6.5
• CVE-2024-32472excalidraw is an open source virtual hand-drawn style whiteb…6.1
• CVE-2024-32473Moby is an open source container framework that is a key com…6.5
• CVE-2024-32474Sentry is an error tracking and performance monitoring platf…6.5