Vulnerability · Published Oct 8, 2025 · Assigned by GitHub_M

CVE-2025-61787Deno is Vulnerable to Command Injection on Windows During Batch File Execution

High 8.1

In plain English

A high-severity command injection in deno from denoland. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)2.1%top 18.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions prior to 2.5.3 and 2.2.15 are vulnerable to Command Line Injection attacks on Windows when batch files are executed. In Windows, ``CreateProcess()`` always implicitly spawns ``cmd.exe`` if a batch file (.bat, .cmd, etc.) is being executed even if the application does not specify it via the command line. This makes Deno vulnerable to a command injection attack on Windows. Versions 2.5.3 and 2.2.15 fix the issue.

Affected products (as reported)

Vendor	Product	Versions
denoland	deno	>= 2.3.0, < 2.5.3< 2.2.15

Weakness: CWE-77 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/denoland/deno/security/advisories/GHSA-m2gf-x3f6-8hq3 x_refsource_CONFIRM
https://github.com/denoland/deno/pull/30818 x_refsource_MISC
https://github.com/denoland/deno/commit/8a0990ccd37bafd8768176ca64b906ba2da2d822 x_refsource_MISC
https://github.com/denoland/deno/releases/tag/v2.2.15 x_refsource_MISC
https://github.com/denoland/deno/releases/tag/v2.5.3 x_refsource_MISC