{"id":"EUVD-2025-31878","revision":"5cdd0c5a4ed9468a8d3c3763e984d19c","records":[{"revision":"5cdd0c5a4ed9468a8d3c3763e984d19c","observedAt":"2026-11-01T01:11:16.174+00:00","statement":{"source":"euvd","id":"EUVD-2025-31878","aliases":["CVE-2025-61785","GHSA-vg2r-rmgp-cgqj"],"title":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. In versions prior to 2.5.3 and 2.2.15, `Deno.FsFile.prototype.utime` and `Deno.FsFile.prototype.utimeSync` are not limited by the permission model check `--deny-write=./`. It's poss…","description":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. In versions prior to 2.5.3 and 2.2.15, `Deno.FsFile.prototype.utime` and `Deno.FsFile.prototype.utimeSync` are not limited by the permission model check `--deny-write=./`. It's possible to change to change the access (`atime`) and modification (`mtime`) times on the file stream resource even when the file is opened with `read` only permission (and `write`: `false`) and file write operations are not allowed (the script is executed with `--deny-write=./`). Similar APIs like `Deno.utime` and `Deno.utimeSync` require\u00A0`allow-write`\u00A0permission, however, when a file is opened, even with read only flags and deny-write permission, it's still possible to change the access (`atime`) and modification (`mtime`) times, and thus bypass the permission model. Versions 2.5.3 and 2.2.15 fix the issue.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.0","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","score":3.3,"severity":null}],"references":["https://github.com/denoland/deno/security/advisories/GHSA-vg2r-rmgp-cgqj","https://github.com/denoland/deno/pull/30872","https://github.com/denoland/deno/commit/992e998dfe436cdc9325232759af8be92f11739b","https://github.com/denoland/deno/releases/tag/v2.2.15","https://github.com/denoland/deno/releases/tag/v2.5.3"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-31878","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 8, 2025, 12:37:01 AM","dateUpdated":"Oct 8, 2025, 6:59:12 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-31878","identifiers":["EUVD-2025-31878","CVE-2025-61785","GHSA-vg2r-rmgp-cgqj"]},"retained":false,"historicalAffected":[]}],"coverage":[]}