Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Deno's Deny-Env Option Ignored by toObject Method

published 6 months ago

Summary

Deno's Deny-Env option is bypassed when using toObject. This means that environment variables listed in Deny-Env can still be accessed using this method. If you're using Deno and rely on the Deny-Env option to restrict access to sensitive environment variables, you should avoid using toObject and instead use the get method to access individual variables. Update your code to use get instead of toObject to maintain the intended security restrictions.

What to do

Update juliabinarywrappers deno_jll to version 2.6.3+0.

Affected software

Ecosystem	Vendor	Product	Affected versions
Julia	juliabinarywrappers	deno_jll	< 2.6.3+0 Fix: upgrade to 2.6.3+0

Original advisory text

Deno.env.toObject() ignores the variables listed in --deny-env and returns all environment variables

### Summary

The [Deno.env.toObject](https://docs.deno.com/api/deno/%7E/Deno.Env.toObject) method ignores any variables listed in the `--deny-env` option of the `deno run` command. When looking at the [documentation](https://docs.deno.com/runtime/fundamentals/security/#environment-variables) of the `--deny-env` option this might lead to a false impression that variables listed in the option are impossible to read.

### PoC

```
export AWS_SECRET_ACCESS_KEY=my-secret-aws-key

# Works as expected. The program stops with a "NotCapable" error message
echo 'console.log(Deno.env.get("AWS_SECRET_ACCESS_KEY"));' | deno run \
--allow-env \
--deny-env=AWS_ACCESS_KEY_ID,AWS_SECRET_ACCESS_KEY -

# All enviroment variables are printed and the --deny-env list is completely disregarded
echo 'console.log(Deno.env.toObject());' | deno run \
--allow-env \
--deny-env=AWS_ACCESS_KEY_ID,AWS_SECRET_ACCESS_KEY -
```

The first example using `get` exits with the following error:

```
error: Uncaught (in promise) NotCapable: Requires env access to "AWS_SECRET_ACCESS_KEY", run again with the --allow-env flag
console.log(Deno.env.get("AWS_SECRET_ACCESS_KEY"));
^
at Object.getEnv [as get] (ext:deno_os/30_os.js:124:10)
at file:///$deno$stdin.mts:1:22
```

The second example using `toObject` prints all environment variables:

```
[Object: null prototype] {
...
AWS_SECRET_ACCESS_KEY: "my-secret-aws-key",
...
}
```

### Impact

Software relying on the combination of both flags to allow access to most environment variables except a few sensitive ones will be vulnerable to malicious code trying to steal secrets using the Deno.env.toObject() method.

References

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

8.1 High

Timeline

Published14 Apr 2026

Updated18 Jul 2026

First seen14 Apr 2026

Sources

JLSEC-2026-110 · OSV

Track software like this

Free during beta