CVE-2023-33966 — deno
HIGHCVE-2023-33966 is a high-severity (CVSS 8.6) Improper Privilege Management vulnerability in deno. A fix is available for deno — see the affected versions and patch details below.
Deno missing "--allow-net" permission check for built-in Node modules
Exploitation Status
No confirmed exploitation observed yet
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2023-33966.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
deno🦀deno_runtimeReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects crates.io packages — download data is not available via public APIs for these ecosystems.
Description
Deno is a runtime for JavaScript and TypeScript. In deno 1.34.0 and deno_runtime 0.114.0, outbound HTTP requests made using the built-in node:http or node:https modules are incorrectly not checked against the network permission allow list (--allow-net). Dependencies relying on these built-in modules are subject to the vulnerability too. Users of Deno versions prior to 1.34.0 are unaffected. Deno Deploy users are unaffected. This problem has been patched in Deno v1.34.1 and deno_runtime 0.114.1 and all users are recommended to update to this version. No workaround is available for this issue.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🦀crates.io | deno | ≥ 1.34.0&&< 1.34.1 | 1.34.1cargo update -p deno --precise 1.34.1 |
| 🦀crates.io | deno_runtime | ≥ 0.114.0&&< 0.115.0 | 0.115.0cargo update -p deno_runtime --precise 0.115.0 |
Affected Products
denodenodeno runtimedenoDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for deno, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update deno to 1.34.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2023-33966 is resolved across your whole dependency graph.
Workarounds
Close the privilege gap rather than the entry point: audit which accounts, roles and service identities can reach the affected operation, drop the component to the least privilege it actually needs, and review file and directory permissions created by earlier installs — a default left in place is what makes this reachable.
Frequently Asked Questions
Is CVE-2023-33966 in your dependencies?
Find it across crates.io, including transitive dependencies.