CVE-2024-27931

Name of the Vulnerable Software and Affected Versions Deno versions prior to 1.41.1

Description Insufficient validation of parameters in Deno.makeTemp* APIs would allow for creation of files outside of the allowed directories. This may allow the user to overwrite important files on the system that may affect other systems. A user may provide a prefix or suffix to a Deno.makeTemp* API containing path traversal characters.

Recommendations For Deno versions prior to 1.41.1, update to Deno 1.41.1 to resolve the issue. As a temporary workaround, consider restricting the use of the Deno.makeTemp* APIs to prevent potential exploitation. Avoid using prefixes or suffixes containing path traversal characters in the Deno.makeTemp* APIs until the issue is resolved.