What’s Vulnerable › Vulnerabilities

CVE-2025-48935: Deno has --allow-read / --allow-write permission bypass in `node:sqlite`

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-06-04 · updated 2026-06-17
• Weakness: CWE-863

Description

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 2.2.0 and prior to versions 2.2.5, it is possible to bypass Deno's permission read/write db permission check by using `ATTACH DATABASE` statement. Version 2.2.5 contains a patch for the issue.

Affected products

• denoland deno: from 2.2.0 before 2.2.5 — fixed in 2.2.5

How to fix

Upgrade to a fixed version: denoland deno 2.2.5. Check the vendor advisory for mitigations.

References

• https://github.com/denoland/deno/commit/31a97803995bd94629528ba841b2418d3ca01860
• https://github.com/denoland/deno/security/advisories/GHSA-8vxj-4cph-c596

Get alerted when CVE-2025-48935 or the next vulnerability affects your stack