Log in Start free

Vulnerability · Published Jun 4, 2025 · Assigned by GitHub_M

CVE-2025-48888Deno run with --allow-read and --deny-read flags results in allowed

Medium 5.5

In plain English

A medium-severity incorrect authorization in deno from denoland. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS 4.0)5.5Medium
Exploit odds (30 days)0.4%top 63.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.41.3 and prior to versions 2.1.13, 2.2.13, and 2.3.2, `deno run --allow-read --deny-read main.ts` results in allowed, even though 'deny' should be stronger. The result is the same with all global unary permissions given as `--allow-* --deny-*`. This only affects a nonsensical combination of flags, so there shouldn't be a real impact on the userbase. Users may upgrade to version 2.1.13, 2.2.13, or 2.3.2 to receive a patch.

Affected products (as reported)

VendorProductVersions
denoland deno >= 1.41.3, < 2.1.13>= 2.2.0, < 2.2.13>= 2.3.0, < 2.3.2

Weakness: CWE-863 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

References