{"id":"EUVD-2025-33179","revision":"4b32cf08ea29456ebd9a993180210c3e","records":[{"revision":"4b32cf08ea29456ebd9a993180210c3e","observedAt":"2026-11-05T02:54:39.077+00:00","statement":{"source":"euvd","id":"EUVD-2025-33179","aliases":["CVE-2025-61787","GHSA-m2gf-x3f6-8hq3"],"title":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions prior to 2.5.3 and 2.2.15 are vulnerable to Command Line Injection attacks on Windows when batch files are executed. In Windows, ``CreateProcess()`` always implicitly spawn…","description":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions prior to 2.5.3 and 2.2.15 are vulnerable to Command Line Injection attacks on Windows when batch files are executed. In Windows, ``CreateProcess()`` always implicitly spawns ``cmd.exe`` if a batch file (.bat, .cmd, etc.) is being executed even if the application does not specify it via the command line. This makes Deno vulnerable to a command injection attack on Windows. Versions 2.5.3 and 2.2.15 fix the issue.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.1,"severity":null}],"references":["https://github.com/denoland/deno/security/advisories/GHSA-m2gf-x3f6-8hq3","https://github.com/denoland/deno/pull/30818","https://github.com/denoland/deno/commit/8a0990ccd37bafd8768176ca64b906ba2da2d822","https://github.com/denoland/deno/releases/tag/v2.2.15","https://github.com/denoland/deno/releases/tag/v2.5.3"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-33179","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 8, 2025, 12:59:17 AM","dateUpdated":"Oct 8, 2025, 6:51:09 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-33179","identifiers":["EUVD-2025-33179","CVE-2025-61787","GHSA-m2gf-x3f6-8hq3"]},"retained":false,"historicalAffected":[]}],"coverage":[]}