CVE-2025-61785

Name
CVE-2025-61785
Description
Deno is a JavaScript, TypeScript, and WebAssembly runtime. In versions prior to 2.5.3 and 2.2.15, `Deno.FsFile.prototype.utime` and `Deno.FsFile.prototype.utimeSync` are not limited by the permission model check `--deny-write=./`. It's possible to change to change the access (`atime`) and modification (`mtime`) times on the file stream resource even when the file is opened with `read` only permission (and `write`: `false`) and file write operations are not allowed (the script is executed with `--deny-write=./`). Similar APIs like `Deno.utime` and `Deno.utimeSync` require `allow-write` permission, however, when a file is opened, even with read only flags and deny-write permission, it's still possible to change the access (`atime`) and modification (`mtime`) times, and thus bypass the permission model. Versions 2.5.3 and 2.2.15 fix the issue.
NVD Severity
unknown
Other trackers
Mailing lists
Exploits
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://github.com/denoland/deno/commit/992e998dfe436cdc9325232759af8be92f11739b
MISC https://github.com/denoland/deno/pull/30872
MISC https://github.com/denoland/deno/releases/tag/v2.2.15
MISC https://github.com/denoland/deno/releases/tag/v2.5.3
CONFIRM https://github.com/denoland/deno/security/advisories/GHSA-vg2r-rmgp-cgqj

Match rules

CPE URI Source package Min version Max version
deno >= 2.3.0 < 2.5.3
deno >= 0 < 2.2.15
cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:* deno >= None <= 2.2.15

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
deno edge-community 2.3.1-r4 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
deno edge-community 2.3.1-r3 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
deno edge-community 2.3.1-r2 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
deno edge-community 2.3.1-r1 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
deno edge-community 2.3.1-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
deno edge-community 2.0.6-r2 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
deno edge-community 2.0.6-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
deno 3.22-community 2.3.1-r2 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
deno 3.22-community 2.0.6-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable