{"id":"EUVD-2025-33179","enisaUuid":"403a59b3-2054-3f4f-a408-ff104afef8e3","description":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions prior to 2.5.3 and 2.2.15 are vulnerable to Command Line Injection attacks on Windows when batch files are executed. In Windows, ``CreateProcess()`` always implicitly spawns ``cmd.exe`` if a batch file (.bat, .cmd, etc.) is being executed even if the application does not specify it via the command line. This makes Deno vulnerable to a command injection attack on Windows. Versions 2.5.3 and 2.2.15 fix the issue.","datePublished":"Oct 8, 2025, 12:59:17 AM","dateUpdated":"Oct 8, 2025, 6:51:09 PM","baseScore":8.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/denoland/deno/security/advisories/GHSA-m2gf-x3f6-8hq3\nhttps://github.com/denoland/deno/pull/30818\nhttps://github.com/denoland/deno/commit/8a0990ccd37bafd8768176ca64b906ba2da2d822\nhttps://github.com/denoland/deno/releases/tag/v2.2.15\nhttps://github.com/denoland/deno/releases/tag/v2.5.3\n","aliases":"CVE-2025-61787\nGHSA-m2gf-x3f6-8hq3\n","assigner":"GitHub_M","epss":2.08,"enisaIdProduct":[{"id":"347967ab-afa2-3fac-817d-14e69166bf75","product":{"name":"deno","vendor":{"name":"denoland"}},"product_version":"2.3.0, \u003c 2.5.3"},{"id":"b79990fc-f314-32b9-8568-2441b6c84e84","product":{"name":"deno","vendor":{"name":"denoland"}},"product_version":"\u003c 2.2.15"}],"enisaIdVendor":[{"id":"d8cb166d-1683-3992-92af-4b1b28c77138","vendor":{"name":"denoland"}}],"enisaIdVulnerability":[{"id":"38d1d2b6-e3fd-316d-91e7-f9527ce42996","vulnerability":{"id":"GHSA-m2gf-x3f6-8hq3","description":"Deno is Vulnerable to Command Injection on Windows During Batch File Execution","datePublished":"Oct 8, 2025, 6:16:24 PM","dateUpdated":"Oct 8, 2025, 6:16:24 PM","baseScore":0.0,"references":"https://github.com/denoland/deno/security/advisories/GHSA-m2gf-x3f6-8hq3\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-61787\nhttps://github.com/denoland/deno/pull/30818\nhttps://github.com/denoland/deno/commit/8a0990ccd37bafd8768176ca64b906ba2da2d822\nhttps://github.com/denoland/deno\nhttps://github.com/denoland/deno/releases/tag/v2.2.15\nhttps://github.com/denoland/deno/releases/tag/v2.5.2\n","enisa_id":"EUVD-2025-33179\n","aliases":"CVE-2025-61787\nGHSA-m2gf-x3f6-8hq3\n","epss":0.0,"dataProcessed":"Nov 8, 2026, 1:53:16 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"8c31233a-061d-3ed5-b97d-54af42254076","vulnerability":{"id":"CVE-2025-61787","description":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions prior to 2.5.3 and 2.2.15 are vulnerable to Command Line Injection attacks on Windows when batch files are executed. In Windows, ``CreateProcess()`` always implicitly spawns ``cmd.exe`` if a batch file (.bat, .cmd, etc.) is being executed even if the application does not specify it via the command line. This makes Deno vulnerable to a command injection attack on Windows. Versions 2.5.3 and 2.2.15 fix the issue.","datePublished":"Oct 8, 2025, 12:59:17 AM","dateUpdated":"Oct 8, 2025, 6:51:09 PM","status":"PUBLISHED","baseScore":8.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/denoland/deno/security/advisories/GHSA-m2gf-x3f6-8hq3\nhttps://github.com/denoland/deno/pull/30818\nhttps://github.com/denoland/deno/commit/8a0990ccd37bafd8768176ca64b906ba2da2d822\nhttps://github.com/denoland/deno/releases/tag/v2.2.15\nhttps://github.com/denoland/deno/releases/tag/v2.5.3\n","enisa_id":"EUVD-2025-33179\n","assigner":"GitHub_M","epss":2.08,"dataProcessed":"Nov 8, 2026, 7:19:30 AM","vulnerabilityProduct":[{"id":"7361de6a-ffaa-3dfc-92c2-57874b3336c8","product":{"name":"deno","vendor":{"name":"denoland"}},"product_version":"2.3.0, \u003c 2.5.3"},{"id":"c2a1304a-a96c-37a3-af0e-df34db1f4a1e","product":{"name":"deno","vendor":{"name":"denoland"}},"product_version":"\u003c 2.2.15"}],"vulnerabilityVendor":[{"id":"53eb9409-8e93-3ebc-aa5f-fd693af83f2e","vendor":{"name":"denoland"}}]}}],"enisaIdAdvisory":[]}