What is the CVSS score of CVE-2025-48934?

CVE-2025-48934 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Deno are affected by CVE-2025-48934?

Organizations using Deno should be aware of moderate risk from CVE-2025-48934 rated CVSS 5.3. Exploitation could compromise the security of affected deployments.. A patch is available.

Is there a public PoC exploit available for CVE-2025-48934?

Yes, a public proof-of-concept exploit is available for CVE-2025-48934. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-48934?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Deno CVE-2025-48934

EUVD-2025-16913 MEDIUM

Insertion of Sensitive Information Into Sent Data (CWE-201)

2025-06-04 security-advisories@github.com

GHSA-7w8p-chxq-2789

Information Disclosure Deno Suse

5.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SUSE

MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 17:29 euvd

EUVD-2025-16913

Analysis Generated

Mar 14, 2026 - 17:29 vuln.today

Patch released

Mar 14, 2026 - 17:29 nvd

Patch available

PoC Detected

Jul 02, 2025 - 13:43 vuln.today

Public exploit code

CVE Published

Jun 04, 2025 - 20:15 nvd

MEDIUM 5.3

DescriptionGitHub Advisory

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to versions 2.1.13 and 2.2.13, the Deno.env.toObject method ignores any variables listed in the --deny-env option of the deno run command. When looking at the documentation of the --deny-env option this might lead to a false impression that variables listed in the option are impossible to read. Software relying on the combination of both flags to allow access to most environment variables except a few sensitive ones will be vulnerable to malicious code trying to steal secrets using the Deno.env.toObject() method. Versions 2.1.13 and 2.2.13 contains a patch.