CVE-2025-61787

Name
CVE-2025-61787
Description
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions prior to 2.5.3 and 2.2.15 are vulnerable to Command Line Injection attacks on Windows when batch files are executed. In Windows, ``CreateProcess()`` always implicitly spawns ``cmd.exe`` if a batch file (.bat, .cmd, etc.) is being executed even if the application does not specify it via the command line. This makes Deno vulnerable to a command injection attack on Windows. Versions 2.5.3 and 2.2.15 fix the issue.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://github.com/denoland/deno/commit/8a0990ccd37bafd8768176ca64b906ba2da2d822
MISC https://github.com/denoland/deno/pull/30818
MISC https://github.com/denoland/deno/releases/tag/v2.2.15
MISC https://github.com/denoland/deno/releases/tag/v2.5.3
CONFIRM https://github.com/denoland/deno/security/advisories/GHSA-m2gf-x3f6-8hq3

Match rules

CPE URI Source package Min version Max version
deno >= 2.3.0 < 2.5.3
deno >= 0 < 2.2.15
cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:* deno >= None <= 2.2.15

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
deno edge-community 2.0.6-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
deno edge-community 2.0.6-r2 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
deno edge-community 2.3.1-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
deno edge-community 2.3.1-r1 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
deno edge-community 2.3.1-r2 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
deno edge-community 2.3.1-r3 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
deno 3.22-community 2.0.6-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
deno 3.22-community 2.3.1-r2 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
deno edge-community 2.3.1-r4 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable