CVE-2021-32619
Rust vulnerability analysis and mitigation

Overview

Deno, a runtime for JavaScript and TypeScript built with V8 and Rust, was found to have a critical security vulnerability in versions 1.5.0 to 1.10.1. The vulnerability was discovered and disclosed on May 28, 2021, affecting the core functionality of module imports (NVD, GitHub Advisory).

Technical details

The vulnerability allowed modules that are dynamically imported through import() or new Worker to bypass network and file system permission checks when statically importing other modules. The issue has a CVSS v3.1 score of 9.8 (Critical), with attack vector being Network, attack complexity Low, requiring no privileges or user interaction, and affecting confidentiality, integrity, and availability at High levels (GitHub Advisory).

Impact

The vulnerability enabled attackers controlling code executed in a Deno runtime to initiate GET requests to arbitrary URLs on the internet (including LAN) and potentially read their contents, as well as check for the existence of arbitrary paths on the file system and possibly read their contents. In Deno 1.7.x, the vulnerability could be exploited even in a fully sandboxed isolate without any permissions (GitHub Advisory).

Exploitability

The vulnerability was more severe in different versions: In Deno 1.5.x and 1.6.x, only programs dynamically importing untrusted code were affected, while in Deno 1.7.x, all programs importing untrusted code were vulnerable. However, researchers were relatively confident it wasn't abused in the wild, as Deno's default behavior of displaying a green 'Download' message for remote imports would have raised suspicion (GitHub Advisory).

Mitigation and workarounds

The vulnerability was patched in Deno release 1.10.2. Users can upgrade to the latest version using the 'deno upgrade' command. The patch is available through all official download channels. No workarounds are available for this issue (GitHub Advisory).

Additional resources


SourceThis report was generated using AI

Related Rust vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

CVE-2026-53530HIGH8.7
  • Rust logoRust
  • ratex-parser
NoYesAug 21, 2026
CVE-2026-53531MEDIUM6.9
  • Rust logoRust
  • ratex-parser
NoYesAug 21, 2026
GHSA-mc9m-6fm9-pghcMEDIUM6.9
  • Python logoPython
  • zoo-kcl
NoYesAug 20, 2026
GHSA-jgvr-6x5w-hx5wMEDIUM6.9
  • Python logoPython
  • kcl-lib
NoYesAug 20, 2026
CVE-2026-54136MEDIUM5.1
  • Rust logoRust
  • windmill-api
NoYesAug 20, 2026

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management