CVE-2026-49983

Deno: process.loadEnvFile() bypasses env permission checks and mutates process.env with only read access

Published Jun 23, 2026 CVSS 3.1 · 5.2 Medium EPSS < 1% KEV · Not listed

Description

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, environment access is gated by the env permission. You can deny it with --deny-env, or restrict it to a specific allowlist with --allow-env=FOO,BAR. The expectation is that a program running without env permission cannot change process.env. process.loadEnvFile() (the Node-compatible API for loading variables from a .env file) does not honor this. It only checks that the program has read permission for the dotenv file, then writes every key in that file into the process environment — even when env access is denied. In effect, --allow-read plus a writable or attacker-controlled .env file is enough to defeat --deny-env. This vulnerability is fixed in 2.8.1.

Analysis

Technical impact

This vulnerability allows a Deno program to modify process.env even when the env permission is denied. Prior to 2.8.1, environment access is gated by the env permission, which can be denied with --deny-env or restricted with --allow-env. The loadEnvFile() API checks only for read permission on the .env file; it then writes every key from that file into process.env, regardless of the env permission. Consequently, with --allow-read and a writable or attacker-controlled .env file, an application can bypass --deny-env. The flaw falls under CWE‑863 and was fixed in Deno 2.8.1.

Affected Systems

The affected vendor is Denoland, with the Deno runtime. All Deno releases prior to 2.8.1 are impacted. Users running 2.7 or earlier versions, or any release that has not shipped the 2.8.1 patch, are vulnerable to this bypass.

Risk and Exploitability

The CVSS score of 5.2 reflects a moderate severity. The EPSS score is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog. An attacker who allows the program to read a .env file can place arbitrary keys in that file; with --allow-read and --deny-env enabled, the program will still load these keys, effectively subverting the environment permission controls. The attack requires only read access to the .env file, making it straightforward to exploit within a trusted runtime environment.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

denoland

deno

affected

Version	Status	Constraints
`< 2.8.1`	affected	—

Configuration 1 [-]

cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Deno

Version	Status	Scheme	Platform
`[0,2.8.1)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Deno to version 2.8.1 or later to apply the vendor fix
Restrict the use and location of .env files to trusted sources and avoid giving write permissions to untrusted users
When environment access is denied, avoid using process.loadEnvFile and instead load variables through safer mechanisms that respect permission flags

Generated by OpenCVE AI on June 24, 2026 at 10:50 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-4c8g-jvcx-v4hv	Deno: process.loadEnvFile() bypasses env permission checks and mutates process.env with only read access

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.140% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/denoland/deno/security/advisories/GHSA-4c8g-jvcx-v4hv

History

Jun 24, 2026 4:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Deno Deno deno
Vendors & Products		Deno Deno deno

Jun 23, 2026 6:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 23, 2026 5:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, environment access is gated by the env permission. You can deny it with --deny-env, or restrict it to a specific allowlist with --allow-env=FOO,BAR. The expectation is that a program running without env permission cannot change process.env. process.loadEnvFile() (the Node-compatible API for loading variables from a .env file) does not honor this. It only checks that the program has read permission for the dotenv file, then writes every key in that file into the process environment — even when env access is denied. In effect, --allow-read plus a writable or attacker-controlled .env file is enough to defeat --deny-env. This vulnerability is fixed in 2.8.1.
Title		Deno: process.loadEnvFile() bypasses env permission checks and mutates process.env with only read access
Weaknesses		CWE-863
References		https://github.com/denoland/deno/security/advisories/GHSA-4c8g-jvcx-v4hv
Metrics		cvssV3_1 `{'score': 5.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}`