{"id":"EUVD-2025-16915","enisaUuid":"381b96ea-8e6e-3a71-8605-7f73fd0563fc","description":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 2.2.0 and prior to versions 2.2.5, it is possible to bypass Deno\u0027s permission read/write db permission check by using `ATTACH DATABASE` statement. Version 2.2.5 contains a patch for the issue.","datePublished":"Jun 4, 2025, 7:31:26 PM","dateUpdated":"Jun 4, 2025, 8:41:22 PM","baseScore":5.5,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","references":"https://github.com/denoland/deno/security/advisories/GHSA-8vxj-4cph-c596\nhttps://github.com/denoland/deno/commit/31a97803995bd94629528ba841b2418d3ca01860\n","aliases":"CVE-2025-48935\nGHSA-8vxj-4cph-c596\n","assigner":"GitHub_M","epss":0.47,"enisaIdProduct":[{"id":"b7c0e550-4858-30ff-8f0c-7cd19c290d01","product":{"name":"deno","vendor":{"name":"denoland"}},"product_version":"2.2.0, \u003c 2.2.5"}],"enisaIdVendor":[{"id":"9d6d7c7f-096a-3885-8ea7-9b68ebcc0a5c","vendor":{"name":"denoland"}}],"enisaIdVulnerability":[{"id":"14db6fd1-f63a-3737-a25d-6feb351255af","vulnerability":{"id":"CVE-2025-48935","description":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 2.2.0 and prior to versions 2.2.5, it is possible to bypass Deno\u0027s permission read/write db permission check by using `ATTACH DATABASE` statement. Version 2.2.5 contains a patch for the issue.","datePublished":"Jun 4, 2025, 7:31:26 PM","dateUpdated":"Jun 4, 2025, 8:41:22 PM","status":"PUBLISHED","baseScore":5.5,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","references":"https://github.com/denoland/deno/security/advisories/GHSA-8vxj-4cph-c596\nhttps://github.com/denoland/deno/commit/31a97803995bd94629528ba841b2418d3ca01860\n","enisa_id":"EUVD-2025-16915\n","assigner":"GitHub_M","epss":0.47,"dataProcessed":"Oct 31, 2026, 7:15:33 AM","vulnerabilityProduct":[{"id":"85703720-2c6e-39cf-81bf-a53ecdd4eb11","product":{"name":"deno","vendor":{"name":"denoland"}},"product_version":"2.2.0, \u003c 2.2.5"},{"id":"d09b7342-d6d8-40bc-8b09-fe8e1b76b6af","product":{"name":"deno","vendor":{"name":"denoland"}},"product_version":"2.2.0, \u003c 2.2.5"}],"vulnerabilityVendor":[{"id":"9ed7fa2f-a080-30ca-ad5b-5277c00aea50","vendor":{"name":"denoland"}}]}},{"id":"c818db59-18ce-36b4-8bab-fe81315296fe","vulnerability":{"id":"GHSA-8vxj-4cph-c596","description":"Deno has --allow-read / --allow-write permission bypass in `node:sqlite`","datePublished":"Jun 4, 2025, 9:22:27 PM","dateUpdated":"Dec 31, 2025, 9:58:17 PM","baseScore":0.0,"references":"https://github.com/denoland/deno/security/advisories/GHSA-8vxj-4cph-c596\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-48935\nhttps://github.com/denoland/deno/commit/31a97803995bd94629528ba841b2418d3ca01860\nhttps://github.com/denoland/deno\nhttps://rustsec.org/advisories/RUSTSEC-2025-0138.html\n","enisa_id":"EUVD-2025-16915\n","aliases":"GHSA-8vxj-4cph-c596\nCVE-2025-48935\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:54:59 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}