Skip to main content

Deno CVE-2025-48888

| EUVDEUVD-2025-16912 MEDIUM
Incorrect Authorization (CWE-863)
2025-06-04 security-advisories@github.com GHSA-xqxc-x6p3-w683
Authentication Bypass Deno Suse
5.3
CVSS 3.1 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
SUSE
MEDIUM
qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Lifecycle Timeline

5
EUVD ID Assigned
Mar 14, 2026 - 17:29 euvd
EUVD-2025-16912
Analysis Generated
Mar 14, 2026 - 17:29 vuln.today
Patch released
Mar 14, 2026 - 17:29 nvd
Patch available
PoC Detected
Jul 02, 2025 - 14:05 vuln.today
Public exploit code
CVE Published
Jun 04, 2025 - 20:15 nvd
MEDIUM 5.3

DescriptionGitHub Advisory

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.41.3 and prior to versions 2.1.13, 2.2.13, and 2.3.2, deno run --allow-read --deny-read main.ts results in allowed, even though 'deny' should be stronger. The result is the same with all global unary permissions given as --allow-* --deny-*. This only affects a nonsensical combination of flags, so there shouldn't be a real impact on the userbase. Users may upgrade to version 2.1.13, 2.2.13, or 2.3.2 to receive a patch.

Analysis

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.41.3 and prior to versions 2.1.13, 2.2.13, and 2.3.2, deno run --allow-read --deny-read main.ts results in allowed, even though 'deny' should be stronger. The result is the same with all global unary permissions given as --allow-* --deny-*. This only affects a nonsensical combination of flags, so there shouldn't be a real impact on the userbase. Users may upgrade to version 2.1.13, 2.2.13, or 2.3.2 to receive a patch.

Technical ContextAI

This vulnerability is classified as Incorrect Authorization (CWE-863).

RemediationAI

A vendor patch is available. Apply it as soon as possible and verify the fix.

More in Deno

View all
CVE-2025-48935 CRITICAL POC
9.1 Jun 04

Deno versions 2.2.0 through 2.2.4 contain an authorization bypass vulnerability in SQLite database handling that allows

CVE-2024-27934 HIGH POC
8.8 Mar 21

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Rated high severity (CVSS 8.8), this vulnerability is low att
CVE-2024-27933 HIGH POC
8.8 Mar 21

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Rated high severity (CVSS 8.8), this vulnerability is low att
CVE-2023-28446 HIGH POC
8.8 Mar 24

Deno is a simple, modern and secure runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Rated high

CVE-2024-27935 HIGH POC
8.3 Mar 21

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Rated high severity (CVSS 8.3), this vulnerability is remotel
CVE-2026-27190 HIGH POC
8.1 Feb 20

Command injection in Deno versions prior to 2.6.8 allows unauthenticated remote attackers to execute arbitrary commands

CVE-2026-22864 HIGH POC
8.1 Jan 15

Arbitrary code execution in Deno runtime versions before 2.5.6 allows unauthenticated attackers to bypass shell script e
CVE-2026-22863 HIGH POC
7.5 Jan 15

Deno versions up to 2.6.0 contains a vulnerability that allows attackers to have infinite encryptions (CVSS 7.5).
CVE-2023-26103 HIGH POC
7.5 Feb 25

Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upg
CVE-2023-22499 HIGH POC
7.5 Jan 17

Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Rated high severity (CVSS 7.5), this

CVE-2024-32477 HIGH POC
7.4 Apr 18

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. Rated high severity (CVSS 7.4), this vul
CVE-2024-27936 MEDIUM POC
6.5 Mar 21

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. Rated medium severity (CVSS 6.5), this v

Same weakness CWE-863 – Incorrect Authorization

View all
CVE-2025-54253 CRITICAL POC
10.0
CVE-2025-24200 MEDIUM
6.1
CVE-2023-21715 HIGH
7.3
CVE-2025-21480 HIGH
8.6
CVE-2025-21479 HIGH
8.6
CVE-2025-32462 HIGH POC
8.8
CVE-2017-4915 HIGH POC
7.8
CVE-2024-6782 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Medium

Share

CVE-2025-48888 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy