CVE-2021-41641: Link Following in Deno

June 13, 2022 (updated June 23, 2022)

Deno <=1.14.0 file sandbox does not handle symbolic links correctly. When running Deno with specific write access, the Deno.symlink method can be used to gain access to any directory.

References

github.com/advisories/GHSA-67hm-27mx-9cg7
github.com/denoland/deno/commit/d44011a69e0674acfa9c59bd7ad7f0523eb61d42
github.com/denoland/deno/issues/12152
github.com/denoland/deno/pull/12554
hackers.report/report/614876917a7b150012836bb8
nvd.nist.gov/vuln/detail/CVE-2021-41641

Code Behaviors & Features

Detect and mitigate CVE-2021-41641 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →