gitsafehub
github.com/robfig/deno ↗

robfig/deno

scanned 2026-08-07 · git 8b49d94
2 of 6 checks flagged a security issue
🔴 Needs attention
Only 4 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets—Vulnerable dependencies53Known OSS vulnerabilities73Risky code patterns✓Malicious dependencies✓Project health—

Security checks

Leaked secrets — Gitleaksⓘ timed out

API keys, passwords or tokens committed into the repo.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Gitleaks v8.21.2 · MIT

error: timeout after 120s

Vulnerable dependencies — Trivyⓘ 53 found · 3 serious

Packages you depend on that have known security holes (CVEs).

  • Serious CVE-2021-45688 Use of Uninitialized Resource in ash.
    Cargo.lock
    A package you depend on has a known security hole (CVE-2021-45688). Fix: Update that package to its patched version.
  • Serious CVE-2021-32619 Deno's static imports inside dynamically imported modules do not adhere to permission checks
    Cargo.lock
    A package you depend on has a known security hole (CVE-2021-32619). Fix: Update that package to its patched version.
  • Serious CVE-2026-22863 Deno node:crypto doesn't finalize cipher
    Cargo.lock
    A package you depend on has a known security hole (CVE-2026-22863). Fix: Update that package to its patched version.
  • Worth fixing GHSA-qj69-c89v-jwq2 Reading on uninitialized memory may cause UB ( `util::read_spv()` )
    Cargo.lock
    A package you depend on has a known security hole (GHSA-qj69-c89v-jwq2). Fix: Update that package to its patched version.
  • Worth fixing GHSA-f85w-wvc7-crwc bumpalo has use-after-free due to a lifetime error in `Vec::into_iter()`
    Cargo.lock
    A package you depend on has a known security hole (GHSA-f85w-wvc7-crwc). Fix: Update that package to its patched version.
  • Worth fixing CVE-2022-23639 crossbeam-utils provides atomics, synchronization primitives, scoped t ...
    Cargo.lock
    A package you depend on has a known security hole (CVE-2022-23639). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-41641 Link Following in Deno
    Cargo.lock
    A package you depend on has a known security hole (CVE-2021-41641). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-28446 Interactive `run` permission prompt spoofing via improper ANSI neutralization
    Cargo.lock
    A package you depend on has a known security hole (CVE-2023-28446). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-34346 Deno permission escalation vulnerability via open of privileged files with missing `--deny` flag
    Cargo.lock
    A package you depend on has a known security hole (CVE-2024-34346). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-21620 fetch: Authorization headers not dropped when redirecting cross-origin
    Cargo.lock
    A package you depend on has a known security hole (CVE-2025-21620). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-61787 Deno is Vulnerable to Command Injection on Windows During Batch File Execution
    Cargo.lock
    A package you depend on has a known security hole (CVE-2025-61787). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-22864 Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass
    Cargo.lock
    A package you depend on has a known security hole (CVE-2026-22864). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-27190 Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process
    Cargo.lock
    A package you depend on has a known security hole (CVE-2026-27190). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-49401 Deno: Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)
    Cargo.lock
    A package you depend on has a known security hole (CVE-2026-49401). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-49402 Deno: Command Injection via spawnSync & spawn on Windows
    Cargo.lock
    A package you depend on has a known security hole (CVE-2026-49402). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-49440 Deno: Miller-Rabin Primality Test Allows Zero Rounds
    Cargo.lock
    A package you depend on has a known security hole (CVE-2026-49440). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-21486 Deno vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
    Cargo.lock
    A package you depend on has a known security hole (CVE-2024-21486). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-27931 Insufficient permission checking in `Deno.makeTemp*` APIs
    Cargo.lock
    A package you depend on has a known security hole (CVE-2024-27931). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-27932 Deno's improper suffix match testing for DENO_AUTH_TOKENS
    Cargo.lock
    A package you depend on has a known security hole (CVE-2024-27932). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-48934 Deno.env.toObject() ignores the variables listed in --deny-env and returns all environment variables
    Cargo.lock
    A package you depend on has a known security hole (CVE-2025-48934). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-49406 Deno: BYONM module resolution allows `package.json` main path traversal to bypass `--allow-read` restrictions
    Cargo.lock
    A package you depend on has a known security hole (CVE-2026-49406). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-49411 Deno: Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks
    Cargo.lock
    A package you depend on has a known security hole (CVE-2026-49411). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-49859 Deno: `fetch()` API sandbox bypass via missing DNS resolution check
    Cargo.lock
    A package you depend on has a known security hole (CVE-2026-49859). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-49860 Deno: WebSocket API sandbox bypass via missing post-DNS check
    Cargo.lock
    A package you depend on has a known security hole (CVE-2026-49860). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-49983 Deno: process.loadEnvFile() bypasses env permission checks and mutates process.env with only read access
    Cargo.lock
    A package you depend on has a known security hole (CVE-2026-49983). Fix: Update that package to its patched version.
… 28 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 73 found · 6 serious

Your dependencies cross-checked against the OSV vulnerability database.

  • Serious RUSTSEC-2021-0065 anymap is unmaintained.
    /workdirs/scan-350f657e-1400-4215-9d94-719799d6d947/Cargo.lock
    A package you depend on has a known security hole (CVE-2021-38187). Fix: Update that package to its patched version.
  • Serious RUSTSEC-2021-0090 Reading on uninitialized memory may cause UB ( `util::read_spv()` )
    /workdirs/scan-350f657e-1400-4215-9d94-719799d6d947/Cargo.lock
    A package you depend on has a known security hole (CVE-2021-45688). Fix: Update that package to its patched version.
  • Serious GHSA-5379-f5hf-w38v Deno node:crypto doesn't finalize cipher
    /workdirs/scan-350f657e-1400-4215-9d94-719799d6d947/Cargo.lock
    A package you depend on has a known security hole (CVE-2026-22863). Fix: Update that package to its patched version.
  • Serious GHSA-xpwj-7v8q-mcgj Deno's static imports inside dynamically imported modules do not adhere to permission checks
    /workdirs/scan-350f657e-1400-4215-9d94-719799d6d947/Cargo.lock
    A package you depend on has a known security hole (CVE-2021-32619). Fix: Update that package to its patched version.
  • Serious RUSTSEC-2021-0091 Reading on uninitialized buffer may cause UB ( `gfx_auxil::read_spirv()` )
    /workdirs/scan-350f657e-1400-4215-9d94-719799d6d947/Cargo.lock
    A package you depend on has a known security hole (CVE-2021-45689). Fix: Update that package to its patched version.
  • Serious RUSTSEC-2021-0079 Integer overflow in `hyper`'s parsing of the `Transfer-Encoding` header leads to data loss
    /workdirs/scan-350f657e-1400-4215-9d94-719799d6d947/Cargo.lock
    A package you depend on has a known security hole (CVE-2021-32714). Fix: Update that package to its patched version.
  • Worth fixing RUSTSEC-2022-0041 Unsoundness of AtomicCell<*64> arithmetics on 32-bit targets that support Atomic*64
    /workdirs/scan-350f657e-1400-4215-9d94-719799d6d947/Cargo.lock
    A package you depend on has a known security hole (CVE-2022-23639). Fix: Update that package to its patched version.
  • Worth fixing GHSA-23rx-c3g5-hv9w Deno permission escalation vulnerability via open of privileged files with missing `--deny` flag
    /workdirs/scan-350f657e-1400-4215-9d94-719799d6d947/Cargo.lock
    A package you depend on has a known security hole (CVE-2024-34346). Fix: Update that package to its patched version.
  • Worth fixing GHSA-4c8g-jvcx-v4hv Deno: process.loadEnvFile() bypasses env permission checks and mutates process.env with only read access
    /workdirs/scan-350f657e-1400-4215-9d94-719799d6d947/Cargo.lock
    A package you depend on has a known security hole (CVE-2026-49983). Fix: Update that package to its patched version.
  • Worth fixing GHSA-5frw-4rwq-xhcr Deno's improper suffix match testing for DENO_AUTH_TOKENS
    /workdirs/scan-350f657e-1400-4215-9d94-719799d6d947/Cargo.lock
    A package you depend on has a known security hole (CVE-2024-27932). Fix: Update that package to its patched version.
  • Worth fixing GHSA-67hm-27mx-9cg7 Link Following in Deno
    /workdirs/scan-350f657e-1400-4215-9d94-719799d6d947/Cargo.lock
    A package you depend on has a known security hole (CVE-2021-41641). Fix: Update that package to its patched version.
  • Worth fixing GHSA-7w8p-chxq-2789 Deno.env.toObject() ignores the variables listed in --deny-env and returns all environment variables
    /workdirs/scan-350f657e-1400-4215-9d94-719799d6d947/Cargo.lock
    A package you depend on has a known security hole (CVE-2025-48934). Fix: Update that package to its patched version.
  • Worth fixing GHSA-7xh3-mhg9-jcw8 Deno: Command Injection via spawnSync & spawn on Windows
    /workdirs/scan-350f657e-1400-4215-9d94-719799d6d947/Cargo.lock
    A package you depend on has a known security hole (CVE-2026-49402). Fix: Update that package to its patched version.
  • Worth fixing GHSA-83pc-3rw9-qpwj Deno: WebSocket API sandbox bypass via missing post-DNS check
    /workdirs/scan-350f657e-1400-4215-9d94-719799d6d947/Cargo.lock
    A package you depend on has a known security hole (CVE-2026-49860). Fix: Update that package to its patched version.
  • Worth fixing GHSA-8xpq-cjcf-3wh9 Deno: Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)
    /workdirs/scan-350f657e-1400-4215-9d94-719799d6d947/Cargo.lock
    A package you depend on has a known security hole (CVE-2026-49401). Fix: Update that package to its patched version.
  • Worth fixing GHSA-968w-xfqw-vp9q Deno: BYONM module resolution allows `package.json` main path traversal to bypass `--allow-read` restrictions
    /workdirs/scan-350f657e-1400-4215-9d94-719799d6d947/Cargo.lock
    A package you depend on has a known security hole (CVE-2026-49406). Fix: Update that package to its patched version.
  • Worth fixing GHSA-9xg4-qhm4-g43w Deno: Miller-Rabin Primality Test Allows Zero Rounds
    /workdirs/scan-350f657e-1400-4215-9d94-719799d6d947/Cargo.lock
    A package you depend on has a known security hole (CVE-2026-49440). Fix: Update that package to its patched version.
  • Worth fixing GHSA-cpgj-f7g3-2pp2 Deno: `fetch()` API sandbox bypass via missing DNS resolution check
    /workdirs/scan-350f657e-1400-4215-9d94-719799d6d947/Cargo.lock
    A package you depend on has a known security hole (CVE-2026-49859). Fix: Update that package to its patched version.
  • Worth fixing GHSA-f27p-cmv8-xhm6 fetch: Authorization headers not dropped when redirecting cross-origin
    /workdirs/scan-350f657e-1400-4215-9d94-719799d6d947/Cargo.lock
    A package you depend on has a known security hole (CVE-2025-21620). Fix: Update that package to its patched version.
  • Worth fixing GHSA-hmh4-3xvx-q5hr Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process
    /workdirs/scan-350f657e-1400-4215-9d94-719799d6d947/Cargo.lock
    A package you depend on has a known security hole (CVE-2026-27190). Fix: Update that package to its patched version.
  • Worth fixing GHSA-hrqr-jv8w-v9jh Insufficient permission checking in `Deno.makeTemp*` APIs
    /workdirs/scan-350f657e-1400-4215-9d94-719799d6d947/Cargo.lock
    A package you depend on has a known security hole (CVE-2024-27931). Fix: Update that package to its patched version.
  • Worth fixing GHSA-jv4x-jv3h-qff5 Deno vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
    /workdirs/scan-350f657e-1400-4215-9d94-719799d6d947/Cargo.lock
    A package you depend on has a known security hole (CVE-2024-21486). Fix: Update that package to its patched version.
  • Worth fixing GHSA-m2gf-x3f6-8hq3 Deno is Vulnerable to Command Injection on Windows During Batch File Execution
    /workdirs/scan-350f657e-1400-4215-9d94-719799d6d947/Cargo.lock
    A package you depend on has a known security hole (CVE-2025-61787). Fix: Update that package to its patched version.
  • Worth fixing GHSA-m3c4-prhw-mrx6 Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass
    /workdirs/scan-350f657e-1400-4215-9d94-719799d6d947/Cargo.lock
    A package you depend on has a known security hole (CVE-2026-22864). Fix: Update that package to its patched version.
  • Worth fixing GHSA-v8fw-85r8-5m23 Deno: Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks
    /workdirs/scan-350f657e-1400-4215-9d94-719799d6d947/Cargo.lock
    A package you depend on has a known security hole (CVE-2026-49411). Fix: Update that package to its patched version.
… 48 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.