CVE-2025-61786
LOW EPSS 7.6%
Published Oct 8, 20258mo ago · Modified Jun 17, 20261w ago
3.3 CVSS 3.1
Published Oct 8, 2025 8mo ago
Last Modified Jun 17, 2026 1w ago
Description
Deno is a JavaScript, TypeScript, and WebAssembly runtime. In versions prior to 2.5.3 and 2.2.15, `Deno.FsFile.prototype.stat` and `Deno.FsFile.prototype.statSync` are not limited by the permission model check `--deny-read=./`. It's possible to retrieve stats from files that the user do not have explicit read access to (the script is executed with `--deny-read=./`). Similar APIs like `Deno.stat` and `Deno.statSync` require `allow-read` permission, however, when a file is opened, even with file-write only flags and deny-read permission, it's still possible to retrieve file stats, and thus bypass the permission model. Versions 2.5.3 and 2.2.15 fix the issue.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity None
Availability None
Threat Intelligence
EPSS Exploit Probability
7.6% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available
Weaknesses 1
CWE-269 Improper Privilege Management Authorization
Affected Products 2
References 5
- github.com https://github.com/denoland/deno/commit/1ab2268c0bcbf9b0468e0e36963f77f8c31c73ec
- github.com https://github.com/denoland/deno/pull/30876
- github.com https://github.com/denoland/deno/releases/tag/v2.2.15
- github.com https://github.com/denoland/deno/releases/tag/v2.5.3
- github.com https://github.com/denoland/deno/security/advisories/GHSA-qq26-84mh-26j9
Remediation
- github.com https://github.com/denoland/deno/commit/1ab2268c0bcbf9b0468e0e36963f77f8c31c73ec
- github.com https://github.com/denoland/deno/pull/30876