CVE-2021-41641
Link Following in Deno
8.4
HIGH
CVSS 3.1
EPSS 0.13%
Description
Deno <=1.14.0 file sandbox does not handle symbolic links correctly. When running Deno with specific write access, the Deno.symlink method can be used to gain access to any directory.
How to fix CVE-2021-41641
To remediate CVE-2021-41641, upgrade the affected package to a fixed version below.
- crates.io/deno—upgrade to 1.16.0 or later
Is CVE-2021-41641 being exploited?
Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 1.16.0
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH8.4 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N |