Medium severityNVD Advisory· Published Nov 22, 2024· Updated Apr 15, 2026

CVE-2024-52793

Description

The Deno Standard Library provides APIs for Deno and the Web. Prior to version 1.0.11, http/file-server's serveDir with showDirListing: true option is vulnerable to cross-site scripting when the attacker is a user who can control file names in the source directory on systems with POSIX file names. Exploitation might also be possible on other systems but less trivial due to e.g. lack of file name support for <> in Windows. Version 1.0.11 fixes the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Denoland/Stdreferences
Denoland/Deno Standard Libraryllm-create
Range: <1.0.11

Patches

Vulnerability mechanics

References

github.com/denoland/std/blob/065296ca5a05a47f9741df8f99c32fae4f960070/http/file_server.tsnvd
github.com/denoland/std/blob/065296ca5a05a47f9741df8f99c32fae4f960070/http/file_server.tsnvd
github.com/denoland/std/security/advisories/GHSA-32fx-h446-h8pfnvd

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000