{"id":"CVE-2025-61787","sourceIdentifier":"security-advisories@github.com","published":"2025-10-08T02:15:41.897","lastModified":"2026-10-08T13:10:00.200","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions prior to 2.5.3 and 2.2.15 are vulnerable to Command Line Injection attacks on Windows when batch files are executed. In Windows, ``CreateProcess()`` always implicitly spawns ``cmd.exe`` if a batch file (.bat, .cmd, etc.) is being executed even if the application does not specify it via the command line. This makes Deno vulnerable to a command injection attack on Windows. Versions 2.5.3 and 2.2.15 fix the issue."},{"lang":"es","value":"Deno es un entorno de ejecución de JavaScript, TypeScript y WebAssembly. Las versiones anteriores a la 2.5.3 y 2.2.15 son vulnerables a ataques de inyección de línea de comandos en Windows cuando se ejecutan archivos por lotes. En Windows, 'CreateProcess()' siempre genera implícitamente 'cmd.exe' si se está ejecutando un archivo por lotes (.bat, .cmd, etc.), incluso si la aplicación no lo especifica a través de la línea de comandos. Esto hace que Deno sea vulnerable a un ataque de inyección de comandos en Windows. Las versiones 2.5.3 y 2.2.15 solucionan el problema."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"denoland","product":"deno","versions":[{"version":">= 2.3.0, < 2.5.3","status":"affected"},{"version":"< 2.2.15","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-10-08T18:47:39.944579Z","id":"CVE-2025-61787","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-77"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:*","versionEndIncluding":"2.2.15","matchCriteriaId":"E75979F4-50DD-41E8-932A-C576F86DBFCF"},{"vulnerable":true,"criteria":"cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:*","versionStartIncluding":"2.3.0","versionEndExcluding":"2.5.3","matchCriteriaId":"7DD66938-204A-4542-BA86-274BB232C8C9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://github.com/denoland/deno/commit/8a0990ccd37bafd8768176ca64b906ba2da2d822","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/denoland/deno/pull/30818","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/denoland/deno/releases/tag/v2.2.15","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/denoland/deno/releases/tag/v2.5.3","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/denoland/deno/security/advisories/GHSA-m2gf-x3f6-8hq3","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]}]}