« Volver al listado

CVE-2024-32468

Estado: AplazadaMedia (5.4)—

Deno is a runtime for JavaScript and TypeScript written in rust. Several cross-site scripting vulnerabilities existed in the `deno_doc` crate which lead to Self-XSS with deno doc --html. 1.) XSS in generated `search_index.js`, `deno_doc` outputs a JavaScript file for searching. However, the generated file used `innerHTML` on unsanitzed HTML input. 2.) XSS via property, method and enum names, `deno_doc` did not sanitize property names, method names and enum names. The first XSS most likely didn't have an impact since `deno doc --html` is expected to be used locally with own packages.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Deno — Deno DOCAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-32468",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-32468",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-11-25T19:17:51.270461Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "denoland",
          "product": "deno",
          "versions": [
            {
              "status": "affected",
              "version": "deno_doc:  < 0.119.0"
            },
            {
              "status": "affected",
              "version": "deno: < 1.42.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-11-25T19:15:09.510",
  "references": [
    {
      "url": "https://github.com/denoland/deno/security/advisories/GHSA-qqwr-j9mm-fhw6",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/denoland/deno_doc/blob/dc556c848831d7ae48f3eff2ababc6e75eb6b73e/src/html/templates/pages/search.js#L120-L144",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Deno is a runtime for JavaScript and TypeScript written in rust. Several cross-site scripting vulnerabilities existed in the `deno_doc` crate which lead to Self-XSS with deno doc --html. 1.) XSS in generated `search_index.js`, `deno_doc` outputs a JavaScript file for searching. However, the generated file used `innerHTML` on unsanitzed HTML input. 2.) XSS via property, method and enum names, `deno_doc` did not sanitize property names, method names and enum names. The first XSS most likely didn't have an impact since `deno doc --html` is expected to be used locally with own packages."
    },
    {
      "lang": "es",
      "value": "Deno es un entorno de ejecución para JavaScript y TypeScript escrito en rust. Existían varias vulnerabilidades de cross-site scripting en el crate `deno_doc` que conducían a Self-XSS con deno doc --html. 1.) XSS en `search_index.js` generado, `deno_doc` genera un archivo JavaScript para realizar búsquedas. Sin embargo, el archivo generado utilizó `innerHTML` en la entrada HTML no desinfectada. 2.) XSS a través de nombres de propiedades, métodos y enumeraciones, `deno_doc` no saneó los nombres de propiedades, métodos y enumeraciones. Lo más probable es que el primer XSS no haya tenido un impacto ya que se espera que `deno doc --html` se use localmente con paquetes propios."
    }
  ],
  "lastModified": "2026-06-17T07:29:41.363",
  "sourceIdentifier": "security-advisories@github.com"
}