Deno CVE-2025-48935

CVSS 9.1 (Critical) reflects the severe nature of an authorization bypass with high confidentiality and integrity impact and low attack complexity. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) indicates this is a network-exploitable vulnerability requiring no privileges or user interaction, making it immediately actionable. The authorization bypass nature (CWE-863) paired with the CVSS score suggests strong real-world risk: an attacker can craft a Deno application or inject SQL statements into an existing application that uses Deno's SQLite support to attach databases outside the intended permission scope. This is particularly critical in sandboxed or multi-tenant Deno environments where permission boundaries are relied upon for isolation. The absence of denial-of-service impact (A:N) is notable—this is a pure confidentiality and integrity breach. Given the straightforward exploitation path (crafting SQL statements), high CVSS, and the foundational nature of permission enforcement in a security-focused runtime, this warrants immediate prioritization. Real-world risk is HIGH: any Deno application using SQLite with version 2.2.0-2.2.4 in a context where database access should be restricted is at significant risk.

An attacker develops or compromises a Deno application that accepts user input for database queries. The application uses Deno's SQLite module with restricted permissions (e.g., permission to read/write only to a specific directory). The attacker crafts a malicious SQL query containing ATTACH DATABASE '/etc/sensitive-data.db' AS secret; followed by SELECT * FROM secret.important_table;. Due to the vulnerability, Deno's permission system does not block the ATTACH statement because it only validates the initial database connection, not subsequent SQL statements. The attacker successfully reads data from a database file outside the application's intended permission scope. In a more severe scenario involving a multi-tenant Deno environment, an attacker could attach and read databases belonging to other tenants. The attack requires no user interaction on the victim's system and works over the network if the Deno application is network-accessible. Proof-of-concept would be straightforward: a simple Deno script using the SQLite module with restricted permissions, executing an ATTACH DATABASE statement to demonstrate the bypass.