CVE-2021-32619: 
Rust vulnerability analysis and mitigation

Deno, a runtime for JavaScript and TypeScript built with V8 and Rust, was found to have a critical security vulnerability in versions 1.5.0 to 1.10.1. The vulnerability was discovered and disclosed on May 28, 2021, affecting the core functionality of module imports (NVD, GitHub Advisory).

The vulnerability allowed modules that are dynamically imported through import() or new Worker to bypass network and file system permission checks when statically importing other modules. The issue has a CVSS v3.1 score of 9.8 (Critical), with attack vector being Network, attack complexity Low, requiring no privileges or user interaction, and affecting confidentiality, integrity, and availability at High levels (GitHub Advisory).

The vulnerability enabled attackers controlling code executed in a Deno runtime to initiate GET requests to arbitrary URLs on the internet (including LAN) and potentially read their contents, as well as check for the existence of arbitrary paths on the file system and possibly read their contents. In Deno 1.7.x, the vulnerability could be exploited even in a fully sandboxed isolate without any permissions (GitHub Advisory).

The vulnerability was more severe in different versions: In Deno 1.5.x and 1.6.x, only programs dynamically importing untrusted code were affected, while in Deno 1.7.x, all programs importing untrusted code were vulnerable. However, researchers were relatively confident it wasn't abused in the wild, as Deno's default behavior of displaying a green 'Download' message for remote imports would have raised suspicion (GitHub Advisory).

The vulnerability was patched in Deno release 1.10.2. Users can upgrade to the latest version using the 'deno upgrade' command. The patch is available through all official download channels. No workarounds are available for this issue (GitHub Advisory).