CVE-2025-61786

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-10-08

Last updated on: 2025-10-16

Assigner: GitHub, Inc.

Description

Deno is a JavaScript, TypeScript, and WebAssembly runtime. In versions prior to 2.5.3 and 2.2.15, `Deno.FsFile.prototype.stat` and `Deno.FsFile.prototype.statSync` are not limited by the permission model check `--deny-read=./`. It's possible to retrieve stats from files that the user do not have explicit read access to (the script is executed with `--deny-read=./`). Similar APIs like `Deno.stat` and `Deno.statSync` require `allow-read` permission, however, when a file is opened, even with file-write only flags and deny-read permission, it's still possible to retrieve file stats, and thus bypass the permission model. Versions 2.5.3 and 2.2.15 fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-08

Last Modified

2025-10-16

Generated

2026-07-06

AI Q&A

2025-10-08

EPSS Evaluated

2026-07-05

NVD

CVE-2025-61786

EUVD

EUVD-2025-33180

Affected Vendors & Products

Vendor	Product	Version / Range
deno	deno	to 2.2.15 (inc)
deno	deno	From 2.3.0 (inc) to 2.5.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability in Deno versions prior to 2.5.3 and 2.2.15 allows bypassing the permission model that restricts reading files. Specifically, the methods Deno.FsFile.prototype.stat and statSync do not enforce the --deny-read=./ permission, enabling a script to retrieve file statistics for files it does not have explicit read access to. This happens even when the script is executed with read permissions denied, and the file is opened with write-only flags. The issue is fixed in versions 2.5.3 and 2.2.15.

Impact Analysis

This vulnerability can allow a user or script to obtain metadata about files they should not have access to, potentially exposing sensitive information such as file size, modification times, or existence of files. Although it does not allow reading the file contents, leaking file statistics can aid attackers in reconnaissance or bypassing security controls.

Mitigation Strategies

Upgrade Deno to version 2.5.3 or 2.2.15 or later, as these versions fix the issue where Deno.FsFile.prototype.stat and statSync bypass the permission model.

Hi! I’m here to help you understand CVE-2025-61786. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70