{"id":"EUVD-2025-31878","enisaUuid":"c53ecbcc-93c5-39a0-be9d-6ca423de694d","description":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. In versions prior to 2.5.3 and 2.2.15, `Deno.FsFile.prototype.utime` and `Deno.FsFile.prototype.utimeSync` are not limited by the permission model check `--deny-write\u003d./`. It\u0027s possible to change to change the access (`atime`) and modification (`mtime`) times on the file stream resource even when the file is opened with `read` only permission (and `write`: `false`) and file write operations are not allowed (the script is executed with `--deny-write\u003d./`). Similar APIs like `Deno.utime` and `Deno.utimeSync` require `allow-write` permission, however, when a file is opened, even with read only flags and deny-write permission, it\u0027s still possible to change the access (`atime`) and modification (`mtime`) times, and thus bypass the permission model. Versions 2.5.3 and 2.2.15 fix the issue.","datePublished":"Oct 8, 2025, 12:37:01 AM","dateUpdated":"Oct 8, 2025, 6:59:12 PM","baseScore":3.3,"baseScoreVersion":"3.0","baseScoreVector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","references":"https://github.com/denoland/deno/security/advisories/GHSA-vg2r-rmgp-cgqj\nhttps://github.com/denoland/deno/pull/30872\nhttps://github.com/denoland/deno/commit/992e998dfe436cdc9325232759af8be92f11739b\nhttps://github.com/denoland/deno/releases/tag/v2.2.15\nhttps://github.com/denoland/deno/releases/tag/v2.5.3\n","aliases":"CVE-2025-61785\nGHSA-vg2r-rmgp-cgqj\n","assigner":"GitHub_M","epss":0.2,"enisaIdProduct":[{"id":"f16dcedc-beaf-31c6-9b4e-2a6704b190c2","product":{"name":"deno","vendor":{"name":"denoland"}},"product_version":"2.3.0, \u003c 2.5.3"},{"id":"f341c98b-0bab-3eb0-9879-7425660384d1","product":{"name":"deno","vendor":{"name":"denoland"}},"product_version":"\u003c 2.2.15"}],"enisaIdVendor":[{"id":"ece84a44-3ddc-34e6-b7f0-edceb0c9ad8d","vendor":{"name":"denoland"}}],"enisaIdVulnerability":[{"id":"d674d85e-1f0b-35ec-a0ad-3cf3331bae44","vulnerability":{"id":"CVE-2025-61785","description":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. In versions prior to 2.5.3 and 2.2.15, `Deno.FsFile.prototype.utime` and `Deno.FsFile.prototype.utimeSync` are not limited by the permission model check `--deny-write\u003d./`. It\u0027s possible to change to change the access (`atime`) and modification (`mtime`) times on the file stream resource even when the file is opened with `read` only permission (and `write`: `false`) and file write operations are not allowed (the script is executed with `--deny-write\u003d./`). Similar APIs like `Deno.utime` and `Deno.utimeSync` require `allow-write` permission, however, when a file is opened, even with read only flags and deny-write permission, it\u0027s still possible to change the access (`atime`) and modification (`mtime`) times, and thus bypass the permission model. Versions 2.5.3 and 2.2.15 fix the issue.","datePublished":"Oct 8, 2025, 12:37:01 AM","dateUpdated":"Oct 8, 2025, 6:59:12 PM","status":"PUBLISHED","baseScore":3.3,"baseScoreVersion":"3.0","baseScoreVector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","references":"https://github.com/denoland/deno/security/advisories/GHSA-vg2r-rmgp-cgqj\nhttps://github.com/denoland/deno/pull/30872\nhttps://github.com/denoland/deno/commit/992e998dfe436cdc9325232759af8be92f11739b\nhttps://github.com/denoland/deno/releases/tag/v2.2.15\nhttps://github.com/denoland/deno/releases/tag/v2.5.3\n","enisa_id":"EUVD-2025-31878\n","assigner":"GitHub_M","epss":0.2,"dataProcessed":"Nov 1, 2026, 1:37:41 AM","vulnerabilityProduct":[{"id":"4ef28f98-1796-32b5-a85d-4fe69f579a36","product":{"name":"deno","vendor":{"name":"denoland"}},"product_version":"2.3.0, \u003c 2.5.3"},{"id":"9d4c28bf-4369-3118-9391-49b96575530a","product":{"name":"deno","vendor":{"name":"denoland"}},"product_version":"\u003c 2.2.15"}],"vulnerabilityVendor":[{"id":"a3ba7f24-ab1c-35be-a14b-bbee5fc86dce","vendor":{"name":"denoland"}}]}},{"id":"dd2ebc84-3585-3c20-bd24-0af8e1d0f1ba","vulnerability":{"id":"GHSA-vg2r-rmgp-cgqj","description":"Deno\u0027s --deny-write check does not prevent permission bypass","datePublished":"Oct 7, 2025, 10:36:36 PM","dateUpdated":"Oct 13, 2025, 3:17:42 PM","baseScore":0.0,"references":"https://github.com/denoland/deno/security/advisories/GHSA-vg2r-rmgp-cgqj\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-61785\nhttps://github.com/denoland/deno/pull/30872\nhttps://github.com/denoland/deno/commit/992e998dfe436cdc9325232759af8be92f11739b\nhttps://github.com/denoland/deno\nhttps://github.com/denoland/deno/releases/tag/v2.2.15\nhttps://github.com/denoland/deno/releases/tag/v2.5.3\n","enisa_id":"EUVD-2025-31878\n","aliases":"GHSA-vg2r-rmgp-cgqj\nCVE-2025-61785\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:55:38 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}