denoland deno up to 2.8.0 Node-compatible API process.loadEnvFile authorization

Summaryinfo

A vulnerability labeled as problematic has been found in denoland deno up to 2.8.0. This affects the function process.loadEnvFile of the component Node-compatible API. Executing a manipulation can lead to authorization. This vulnerability is tracked as CVE-2026-49983. The attack is restricted to local execution. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in denoland deno up to 2.8.0. It has been declared as problematic. This vulnerability affects the function process.loadEnvFile of the component Node-compatible API. The manipulation with an unknown input leads to a authorization vulnerability. The CWE definition for the vulnerability is CWE-863. The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, environment access is gated by the env permission. You can deny it with --deny-env, or restrict it to a specific allowlist with --allow-env=FOO,BAR. The expectation is that a program running without env permission cannot change process.env. process.loadEnvFile() (the Node-compatible API for loading variables from a .env file) does not honor this. It only checks that the program has read permission for the dotenv file, then writes every key in that file into the process environment — even when env access is denied. In effect, --allow-read plus a writable or attacker-controlled .env file is enough to defeat --deny-env. This vulnerability is fixed in 2.8.1.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-49983 since 06/02/2026. The exploitation appears to be easy. The attack needs to be approached locally. There are known technical details, but no exploit is available.

Upgrading to version 2.8.1 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• denoland

Name

• deno

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8.0

Website

• Product: https://github.com/denoland/deno/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion