{"id":"EUVD-2025-33180","enisaUuid":"206de127-2b22-3125-ab9e-4c843931b8e0","description":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. In versions prior to 2.5.3 and 2.2.15, `Deno.FsFile.prototype.stat` and `Deno.FsFile.prototype.statSync` are not limited by the permission model check `--deny-read\u003d./`. It\u0027s possible to retrieve stats from files that the user do not have explicit read access to (the script is executed with `--deny-read\u003d./`). Similar APIs like `Deno.stat` and `Deno.statSync` require `allow-read` permission, however, when a file is opened, even with file-write only flags and deny-read permission, it\u0027s still possible to retrieve file stats, and thus bypass the permission model. Versions 2.5.3 and 2.2.15 fix the issue.","datePublished":"Oct 8, 2025, 12:49:42 AM","dateUpdated":"Oct 8, 2025, 6:54:33 PM","baseScore":3.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/denoland/deno/security/advisories/GHSA-qq26-84mh-26j9\nhttps://github.com/denoland/deno/pull/30876\nhttps://github.com/denoland/deno/commit/1ab2268c0bcbf9b0468e0e36963f77f8c31c73ec\nhttps://github.com/denoland/deno/releases/tag/v2.2.15\nhttps://github.com/denoland/deno/releases/tag/v2.5.3\n","aliases":"CVE-2025-61786\nGHSA-qq26-84mh-26j9\n","assigner":"GitHub_M","epss":0.2,"enisaIdProduct":[{"id":"25140f4b-f054-32cf-8f07-77639f32928d","product":{"name":"deno","vendor":{"name":"denoland"}},"product_version":"2.3.0, \u003c 2.5.3"},{"id":"52ae827f-9a80-3fbf-892e-d419de5e6d97","product":{"name":"deno","vendor":{"name":"denoland"}},"product_version":"\u003c 2.2.15"}],"enisaIdVendor":[{"id":"055e2bf6-4692-319c-9c1e-92311e1708ce","vendor":{"name":"denoland"}}],"enisaIdVulnerability":[{"id":"4e7fdafb-3b0f-39c2-92d3-8843c146ab0d","vulnerability":{"id":"GHSA-qq26-84mh-26j9","description":"Deno\u0027s --deny-read check does not prevent permission bypass","datePublished":"Oct 8, 2025, 5:56:40 PM","dateUpdated":"Oct 8, 2025, 5:56:40 PM","baseScore":0.0,"references":"https://github.com/denoland/deno/security/advisories/GHSA-qq26-84mh-26j9\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-61786\nhttps://github.com/denoland/deno/pull/30876\nhttps://github.com/denoland/deno/commit/1ab2268c0bcbf9b0468e0e36963f77f8c31c73ec\nhttps://github.com/denoland/deno\nhttps://github.com/denoland/deno/releases/tag/v2.2.15\nhttps://github.com/denoland/deno/releases/tag/v2.5.3\n","enisa_id":"EUVD-2025-33180\n","aliases":"CVE-2025-61786\nGHSA-qq26-84mh-26j9\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:55:38 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"75cfeaf9-4955-3e34-aa38-c47bf9ac5b94","vulnerability":{"id":"CVE-2025-61786","description":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. In versions prior to 2.5.3 and 2.2.15, `Deno.FsFile.prototype.stat` and `Deno.FsFile.prototype.statSync` are not limited by the permission model check `--deny-read\u003d./`. It\u0027s possible to retrieve stats from files that the user do not have explicit read access to (the script is executed with `--deny-read\u003d./`). Similar APIs like `Deno.stat` and `Deno.statSync` require `allow-read` permission, however, when a file is opened, even with file-write only flags and deny-read permission, it\u0027s still possible to retrieve file stats, and thus bypass the permission model. Versions 2.5.3 and 2.2.15 fix the issue.","datePublished":"Oct 8, 2025, 12:49:42 AM","dateUpdated":"Oct 8, 2025, 6:54:33 PM","status":"PUBLISHED","baseScore":3.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/denoland/deno/security/advisories/GHSA-qq26-84mh-26j9\nhttps://github.com/denoland/deno/pull/30876\nhttps://github.com/denoland/deno/commit/1ab2268c0bcbf9b0468e0e36963f77f8c31c73ec\nhttps://github.com/denoland/deno/releases/tag/v2.2.15\nhttps://github.com/denoland/deno/releases/tag/v2.5.3\n","enisa_id":"EUVD-2025-33180\n","assigner":"GitHub_M","epss":0.2,"dataProcessed":"Nov 1, 2026, 1:37:41 AM","vulnerabilityProduct":[{"id":"03e4cd88-d156-3b67-85ef-b218433e1237","product":{"name":"deno","vendor":{"name":"denoland"}},"product_version":"2.3.0, \u003c 2.5.3"},{"id":"831e3311-b5a8-3990-b442-bcd193d681fe","product":{"name":"deno","vendor":{"name":"denoland"}},"product_version":"\u003c 2.2.15"}],"vulnerabilityVendor":[{"id":"30d6f552-4a61-3482-9322-503f61628091","vendor":{"name":"denoland"}}]}}],"enisaIdAdvisory":[]}