CVE-2025-61786 Details
Description
Deno is a JavaScript, TypeScript, and WebAssembly runtime. In versions prior to 2.5.3 and 2.2.15, `Deno.FsFile.prototype.stat` and `Deno.FsFile.prototype.statSync` are not limited by the permission model check `--deny-read=./`. It's possible to retrieve stats from files that the user do not have explicit read access to (the script is executed with `--deny-read=./`). Similar APIs like `Deno.stat` and `Deno.statSync` require `allow-read` permission, however, when a file is opened, even with file-write only flags and deny-read permission, it's still possible to retrieve file stats, and thus bypass the permission model. Versions 2.5.3 and 2.2.15 fix the issue.
A vulnerability exists in Deno's file stat methods, specifically `Deno.FsFile.prototype.stat` and `Deno.FsFile.prototype.statSync`, in versions prior to 2.5.3 and 2.2.15. These methods can bypass the permission model check `--deny-read=./`, allowing users to access file statistics from files they do not have explicit read permission for. This issue arises because, unlike similar APIs that require `allow-read` permission, the stat methods can be exploited when a file is opened with write-only permissions and deny-read restrictions. The vulnerability allows for unauthorized access to file metadata, creating a potential security risk by undermining the intended permission controls.
Users can upgrade to Deno versions 2.5.3 or 2.2.15, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Oct 8, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-269 | Improper Privilege Management | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| deno deno | <= 2.2.15 >= 2.3.0, < 2.5.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2025 | Initial Analysis | [email protected] |
| Oct 8, 2025 | New CVE Received | [email protected] |