{"id":"EUVD-2025-33180","revision":"c8c8f160788f4865bc4307df88645a51","records":[{"revision":"c8c8f160788f4865bc4307df88645a51","observedAt":"2026-11-07T03:27:26.701+00:00","statement":{"source":"euvd","id":"EUVD-2025-33180","aliases":["CVE-2025-61786","GHSA-qq26-84mh-26j9"],"title":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. In versions prior to 2.5.3 and 2.2.15, `Deno.FsFile.prototype.stat` and `Deno.FsFile.prototype.statSync` are not limited by the permission model check `--deny-read=./`. It's possibl…","description":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. In versions prior to 2.5.3 and 2.2.15, `Deno.FsFile.prototype.stat` and `Deno.FsFile.prototype.statSync` are not limited by the permission model check `--deny-read=./`. It's possible to retrieve stats from files that the user do not have explicit read access to (the script is executed with `--deny-read=./`). Similar APIs like `Deno.stat` and `Deno.statSync` require\u00A0`allow-read`\u00A0permission, however, when a file is opened, even with file-write only flags and deny-read permission, it's still possible to retrieve file stats, and thus bypass the permission model. Versions 2.5.3 and 2.2.15 fix the issue.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":3.3,"severity":null}],"references":["https://github.com/denoland/deno/security/advisories/GHSA-qq26-84mh-26j9","https://github.com/denoland/deno/pull/30876","https://github.com/denoland/deno/commit/1ab2268c0bcbf9b0468e0e36963f77f8c31c73ec","https://github.com/denoland/deno/releases/tag/v2.2.15","https://github.com/denoland/deno/releases/tag/v2.5.3"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-33180","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 8, 2025, 12:49:42 AM","dateUpdated":"Oct 8, 2025, 6:54:33 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-33180","identifiers":["EUVD-2025-33180","CVE-2025-61786","GHSA-qq26-84mh-26j9"]},"retained":false,"historicalAffected":[]}],"coverage":[]}