UpHeron
All vulnerabilities

Servers and applications

CVE-2023-28446

Interactive `run` permission prompt spoofing via improper ANSI neutralization

Severity
High 8.8
Published
23 Mar 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.31.2
Also known as
GHSA-vq67-rp93-65qf
Sources
NVD, Project advisories (GitHub)

Description

Deno is a simple, modern and secure runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Arbitrary program names without any ANSI filtering allows any malicious program to clear the first 2 lines of a `op_spawn_child` or `op_kill` prompt and replace it with any desired text. This works with any command on the respective platform, giving the program the full ability to choose…

Affected software

SoftwareAffected versions
DenoServers and applications · cpe:a:deno:deno
  • Every version before 1.31.2
DenoServers and applications · github:denoland/deno
  • From 1.8.0 before 1.31.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-28446
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-28446
  • GitHub Advisory Database https://github.com/advisories/GHSA-vq67-rp93-65qf
  • github.com https://github.com/denoland/deno/security/advisories/GHSA-vq67-rp93-65qf