Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| deno | rust | <= 2.7.11 | 2.7.12 |
Miggo AIRoot Cause AnalysisThe vulnerability is a path traversal weakness in Deno's "Bring Your Own Node Modules" (BYONM) feature. When a user calls require() on an npm package, Deno's module resolver reads the main field of the package's package.json to find the entrypoint. A malicious package could craft a main field with ../ sequences to point to a file outside of its own directory. The vulnerable code would resolve this path and read the file, bypassing Deno's --allow-read permission checks.
The analysis identified the fixing commit by comparing the git tags of the last vulnerable version (v2.7.11) and the first patched version (v2.7.12). The key commit, 8295a2cf2aabe2ecd9ccce8a802d0d5d61095a2e, is explicitly titled "fix(node): validate resolved main path stays within package directory".
This commit patched the vulnerability in two places:
ext/node/polyfills/01_require.js: In the JavaScript implementation of require, the tryPackage function was modified to add a check ensuring the resolved path of the main entry does not escape the package's root directory.
libs/node_resolver/resolution.rs: In the core Rust implementation, the function legacy_main_resolve (as identified from the commit message) within the NpmPackageResolver was updated to validate the resolved path. It now checks if the resolved path guess still starts with the package_path, preventing traversal.
Both of these functions are directly responsible for processing the malicious package.json and were the points where the path traversal was possible. An exploit would trigger these functions, making them key indicators in a runtime profile.
tryPackageext/node/polyfills/01_require.js
deno_node_resolver::resolution::NpmPackageResolver::legacy_main_resolvelibs/node_resolver/resolution.rs
The reporter supplied a self-contained PoC. Layout:
/tmp/deno_byonm_poc/
├── app/
│ ├── deno.json (BYONM enabled)
│ ├── exploit.ts (require("evil-pkg"))
│ └── node_modules/
│ └── evil-pkg/
│ └── package.json (main: "../../../secret.json")
└── secret.json (outside --allow-read scope)
Run:
deno run --no-prompt --allow-read=/tmp/deno_byonm_poc/app exploit.ts
Observed:
Deno.readTextFileSync("/tmp/deno_byonm_poc/secret.json") — blocked, as
expected.require("evil-pkg") — returned the parsed contents of secret.json,
bypassing the read allowlist.A control run with BYONM disabled (--no-config) blocked the require call.
The vulnerability allowed a hostile npm package installed under a BYONM node_modules to read JSON files outside the directories granted via --allow-read, up to the privileges of the OS user running Deno. In practice this exposed configuration and credential files (.env.json, cloud credentials, package lockfiles, etc.) that the user had deliberately excluded from the read scope.
The vulnerability did not grant any capability beyond what the OS user already held, did not affect runs that granted unrestricted --allow-read, and required the user to have installed and then required a hostile package, i.e. an existing supply-chain compromise. The reason it warranted a security advisory rather than a routine bug fix is that Deno's permission model
promised that --allow-read=<scope> was a hard boundary even over untrusted npm code, and that promise was broken.
Not affected:
--allow-read (no boundary to bypass)..js/.cjs/.mjs targets executed
rather than exposing file contents, which already implied attacker code
execution within the granted permission set.Users on unpatched versions could mitigate by:
nodeModulesDir: "manual") for projects that depended
on untrusted packages.package.json main fields in node_modules for .. segments
before running.--allow-read only when the read scope already covered every file
the OS user could see (in which case there was no boundary to bypass and no
additional exposure).