Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.41.3 and prior to versions 2.1.13, 2.2.13, and 2.3.2, `deno run --allow-read --deny-read main.ts` results in allowed, even though 'deny' should be stronger. The result is the same with all global unary permissions given as `--allow-* --deny-*`. This only affects a nonsensical combination of flags, so there shouldn't be a real impact on the userbase. Users may upgrade to version 2.1.13, 2.2.13, or 2.3.2 to receive a patch.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable yes

Technical Impact partial

Affected Vendors & Products

Vendors Products
Deno
  • Deno

Configuration 1 [-]

OR cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:*
cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:*
cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:*

No data.

References
Link Providers
https://github.com/denoland/deno/commit/2f0fae9d9071dcaf0a689bc7097584b1b9ebc8db cve-icon cve-icon
https://github.com/denoland/deno/commit/9d665572d3cd39f997e29e6daac7c1102fc5c04f cve-icon cve-icon
https://github.com/denoland/deno/commit/ef315b56c26c9ef5f25284a5100d2ed525a148cf cve-icon cve-icon
https://github.com/denoland/deno/pull/22894 cve-icon cve-icon
https://github.com/denoland/deno/pull/29213 cve-icon cve-icon
https://github.com/denoland/deno/security/advisories/GHSA-xqxc-x6p3-w683 cve-icon cve-icon cve-icon
History

Wed, 02 Jul 2025 14:30:00 +0000

Type Values Removed Values Added
First Time appeared Deno
Deno deno
CPEs cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:*
Vendors & Products Deno
Deno deno
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

Wed, 04 Jun 2025 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 04 Jun 2025 19:30:00 +0000

Type Values Removed Values Added
Description Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.41.3 and prior to versions 2.1.13, 2.2.13, and 2.3.2, `deno run --allow-read --deny-read main.ts` results in allowed, even though 'deny' should be stronger. The result is the same with all global unary permissions given as `--allow-* --deny-*`. This only affects a nonsensical combination of flags, so there shouldn't be a real impact on the userbase. Users may upgrade to version 2.1.13, 2.2.13, or 2.3.2 to receive a patch.
Title Deno run with --allow-read and --deny-read flags results in allowed
Weaknesses CWE-863
References
Metrics cvssV4_0

{'score': 5.5, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2025-06-04T19:15:55.041Z

Updated: 2025-06-04T19:32:53.261Z

Reserved: 2025-05-27T20:14:34.297Z

Link: CVE-2025-48888

cve-icon Vulnrichment

Updated: 2025-06-04T19:31:43.733Z

cve-icon NVD

Status : Analyzed

Published: 2025-06-04T20:15:23.977

Modified: 2025-07-02T14:05:20.353

Link: CVE-2025-48888

cve-icon Redhat

No data.