CVE-2025-48935

Deno is a secure-by-default runtime for JavaScript, TypeScript, and WebAssembly that implements a granular permission system to control access to system resources, including file system read/write operations. The vulnerability exists in Deno's SQLite integration (likely via the sql.js or similar WebAssembly SQLite binding) where the permission enforcement layer fails to validate the `ATTACH DATABASE` SQL statement. The `ATTACH DATABASE` clause in SQLite allows attaching additional database files at runtime; Deno's permission model checks are bypassed because the permission validation occurs at the initial database connection level but not during subsequent SQL statement execution. This is a classic example of CWE-863 (Incorrect Authorization) where security checks are applied inconsistently—the initial database open triggers permission validation, but the `ATTACH DATABASE` statement allows loading additional databases without re-checking permissions. Affected versions: Deno 2.2.0, 2.2.1, 2.2.2, 2.2.3, 2.2.4 (CPE: cpe:2.3:a:denoland:deno:2.2.0:*:*:*:*:*:*:* through cpe:2.3:a:denoland:deno:2.2.4:*:*:*:*:*:*:*).