{"cve":"CVE-2024-27932","nvd":{"published":"2024-03-21T02:52:21.953","modified":"2026-06-17T07:20:37.380","status":"Analyzed","description":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.8.0 and prior to version 1.40.4, Deno improperly checks that an import specifier's hostname is equal to or a child of a token's hostname, which can cause tokens to be sent to servers they shouldn't be sent to. An auth token intended for `example[.]com` may be sent to `notexample[.]com`. Anyone who uses DENO_AUTH_TOKENS and imports potentially untrusted code is affected. Version 1.40.0 contains a patch for this issue","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","score":4.6},"cwes":["CWE-20"],"references":["https://github.com/denoland/deno/blob/3f4639c330a31741b0efda2f93ebbb833f4f95bc/cli/auth_tokens.rs#L89","https://github.com/denoland/deno/commit/de23e3b60b066481cc390f459497d5bef42a899b","https://github.com/denoland/deno/security/advisories/GHSA-5frw-4rwq-xhcr","https://github.com/denoland/deno/blob/3f4639c330a31741b0efda2f93ebbb833f4f95bc/cli/auth_tokens.rs#L89","https://github.com/denoland/deno/commit/de23e3b60b066481cc390f459497d5bef42a899b"],"products":["deno:deno"],"source":"nvd","synced_at":"2026-10-19T21:47:51.568503435+00:00"},"epss":{"cve":"CVE-2024-27932","score":0.00594,"percentile":0.48396,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-5frw-4rwq-xhcr","url":"https://osv.dev/vulnerability/GHSA-5frw-4rwq-xhcr","summary":"Deno's improper suffix match testing for DENO_AUTH_TOKENS","modified":"2026-09-10T03:50:10.161608939Z","packages":[{"ecosystem":"crates.io","name":"deno","purl":"pkg:cargo/deno","ranges":[">=1.8.0 <1.40.4"],"fixed":["1.40.4"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}