CVE-2025-61786: Deno's --deny-read check does not prevent permission bypass
Deno.FsFile.prototype.stat and Deno.FsFile.prototype.statSync are not limited by the permission model check --deny-read=./.
It’s possible to retrieve stats from files that the user do not have explicit read access to (the script is executed with --deny-read=./)
Similar APIs like Deno.stat and Deno.statSync require allow-read permission, however, when a file is opened, even with file-write only flags and deny-read permission, it’s still possible to retrieve file stats, and thus bypass the permission model.
References
- github.com/advisories/GHSA-qq26-84mh-26j9
- github.com/denoland/deno
- github.com/denoland/deno/commit/1ab2268c0bcbf9b0468e0e36963f77f8c31c73ec
- github.com/denoland/deno/pull/30876
- github.com/denoland/deno/releases/tag/v2.2.15
- github.com/denoland/deno/releases/tag/v2.5.3
- github.com/denoland/deno/security/advisories/GHSA-qq26-84mh-26j9
- nvd.nist.gov/vuln/detail/CVE-2025-61786
Code Behaviors & Features
Detect and mitigate CVE-2025-61786 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →