CVE-2026-49983

Name of the Vulnerable Software and Affected Versions Deno versions prior to 2.8.1

Description Environment access is managed by the env permission, which can be restricted via --deny-env or an allowlist using --allow-env=FOO,BAR. The process.loadEnvFile() function, a Node-compatible API for loading variables from a .env file, fails to honor these restrictions. It only verifies that the program has read permission for the dotenv file and subsequently writes every key from that file into the process environment, even if environment access is explicitly denied. Consequently, combining --allow-read with a writable or attacker-controlled .env file allows the bypass of --deny-env.

Recommendations Update to version 2.8.1. As a temporary workaround, avoid using the process.loadEnvFile() function until the update is applied.