CVE-2024-32477

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. By using ANSI escape sequences and a race between `libc::tcflush(0, libc::TCIFLUSH)` and reading standard input, it's possible to manipulate the permission prompt and force it to allow an unsafe action regardless of the user input. Some ANSI escape sequences act as a info request to the master terminal emulator and the terminal emulator sends back the reply in the PTY channel. standard streams also use this channel to send and get data. For example the `\033[6n` sequence requests the current cursor position. These sequences allow us to append data to the standard input of Deno. This vulnerability allows an attacker to bypass Deno permission policy. This vulnerability is fixed in 1.42.2.

• CWE-78
• CWE-362

• https://github.com/denoland/deno/security/advisories/GHSA-95cj-3hr2-7j5jExploit, Vendor Advisory
• https://github.com/denoland/deno/security/advisories/GHSA-95cj-3hr2-7j5jExploit, Vendor Advisory

Published

Apr 18, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-32470Tolgee is an open-source localization platform. When API key…6.5
• CVE-2024-32472excalidraw is an open source virtual hand-drawn style whiteb…6.1
• CVE-2024-32473Moby is an open source container framework that is a key com…6.5
• CVE-2024-32474Sentry is an error tracking and performance monitoring platf…6.5
• CVE-2024-32475Envoy is a cloud-native, open source edge and service proxy.…7.5
• CVE-2024-32476Argo CD is a declarative, GitOps continuous delivery tool fo…6.5
• CVE-2024-32478Git Credential Manager (GCM) is a secure Git credential help…6.9
• CVE-2024-32479LibreNMS is an open-source, PHP/MySQL/SNMP-based network mon…5.4
• CVE-2024-3248In Xpdf 4.05 (and earlier), a PDF object loop in the attachm…5.5
• CVE-2024-32480LibreNMS is an open-source, PHP/MySQL/SNMP-based network mon…7.2
• CVE-2024-32481Vyper is a pythonic Smart Contract Language for the Ethereum…5.3
• CVE-2024-32482The Tillitis TKey signer device application is an ed25519 si…2.2