CVE-2025-61787

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions prior to 2.5.3 and 2.2.15 are vulnerable to Command Line Injection attacks on Windows when batch files are executed. In Windows, ``CreateProcess()`` always implicitly spawns ``cmd.exe`` if a batch file (.bat, .cmd, etc.) is being executed even if the application does not specify it via the command line. This makes Deno vulnerable to a command injection attack on Windows. Versions 2.5.3 and 2.2.15 fix the issue.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/denoland/deno/commit/8a0990ccd37bafd8768176ca64b906ba2da2d822	Patch
https://github.com/denoland/deno/pull/30818	Issue Tracking Patch
https://github.com/denoland/deno/releases/tag/v2.2.15	Release Notes
https://github.com/denoland/deno/releases/tag/v2.5.3	Release Notes
https://github.com/denoland/deno/security/advisories/GHSA-m2gf-x3f6-8hq3	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:deno:deno::::::::
	cpe:2.3:a:deno:deno::::::::

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

History

08 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Deno es un entorno de ejecución de JavaScript, TypeScript y WebAssembly. Las versiones anteriores a la 2.5.3 y 2.2.15 son vulnerables a ataques de inyección de línea de comandos en Windows cuando se ejecutan archivos por lotes. En Windows, 'CreateProcess()' siempre genera implícitamente 'cmd.exe' si se está ejecutando un archivo por lotes (.bat, .cmd, etc.), incluso si la aplicación no lo especifica a través de la línea de comandos. Esto hace que Deno sea vulnerable a un ataque de inyección de comandos en Windows. Las versiones 2.5.3 y 2.2.15 solucionan el problema.

Information

Published : 2025-10-08 02:15

Updated : 2026-10-08 13:10

NVD link : CVE-2025-61787

Mitre link : CVE-2025-61787

CVE.ORG link : CVE-2025-61787

JSON object : View

Products Affected

deno

deno

microsoft

windows

CWE

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

{"id": "CVE-2025-61787", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-61787", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-10-08T18:47:39.944579Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "denoland", "product": "deno", "versions": [{"status": "affected", "version": ">= 2.3.0, < 2.5.3"}, {"status": "affected", "version": "< 2.2.15"}]}]}], "published": "2025-10-08T02:15:41.897", "references": [{"url": "https://github.com/denoland/deno/commit/8a0990ccd37bafd8768176ca64b906ba2da2d822", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/denoland/deno/pull/30818", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/denoland/deno/releases/tag/v2.2.15", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/denoland/deno/releases/tag/v2.5.3", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/denoland/deno/security/advisories/GHSA-m2gf-x3f6-8hq3", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions prior to 2.5.3 and 2.2.15 are vulnerable to Command Line Injection attacks on Windows when batch files are executed. In Windows, ``CreateProcess()`` always implicitly spawns ``cmd.exe`` if a batch file (.bat, .cmd, etc.) is being executed even if the application does not specify it via the command line. This makes Deno vulnerable to a command injection attack on Windows. Versions 2.5.3 and 2.2.15 fix the issue."}, {"lang": "es", "value": "Deno es un entorno de ejecuci\u00f3n de JavaScript, TypeScript y WebAssembly. Las versiones anteriores a la 2.5.3 y 2.2.15 son vulnerables a ataques de inyecci\u00f3n de l\u00ednea de comandos en Windows cuando se ejecutan archivos por lotes. En Windows, 'CreateProcess()' siempre genera impl\u00edcitamente 'cmd.exe' si se est\u00e1 ejecutando un archivo por lotes (.bat, .cmd, etc.), incluso si la aplicaci\u00f3n no lo especifica a trav\u00e9s de la l\u00ednea de comandos. Esto hace que Deno sea vulnerable a un ataque de inyecci\u00f3n de comandos en Windows. Las versiones 2.5.3 y 2.2.15 solucionan el problema."}], "lastModified": "2026-10-08T13:10:00.200", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E75979F4-50DD-41E8-932A-C576F86DBFCF", "versionEndIncluding": "2.2.15"}, {"criteria": "cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7DD66938-204A-4542-BA86-274BB232C8C9", "versionEndExcluding": "2.5.3", "versionStartIncluding": "2.3.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "security-advisories@github.com"}