CVE-2025-48888
📋 TL;DR
This CVE describes a permission precedence vulnerability in Deno where 'deny' flags don't properly override 'allow' flags when both are specified for the same permission type. This affects Deno users running scripts with contradictory permission flags, potentially allowing unintended file system or network access.
💻 Affected Systems
- Deno
📦 What is this software?
Deno by Deno
Deno by Deno
Deno by Deno
⚠️ Risk & Real-World Impact
Worst Case
An attacker could exploit contradictory permission configurations to bypass intended security restrictions, potentially gaining unauthorized read/write access to sensitive files or network resources.
Likely Case
Minimal real-world impact since the vulnerability requires nonsensical contradictory permission flags that most users wouldn't intentionally configure.
If Mitigated
No impact if users don't use contradictory permission flags or have upgraded to patched versions.
🎯 Exploit Status
Exploitation requires ability to modify Deno command-line arguments with contradictory permission flags.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.1.13, 2.2.13, or 2.3.2
Vendor Advisory: https://github.com/denoland/deno/security/advisories
Restart Required: No
Instructions:
1. Update Deno using: deno upgrade --version 2.3.2 (or 2.2.13/2.1.13) 2. Verify update with: deno --version
🔧 Temporary Workarounds
Avoid contradictory permission flags
allDo not use both --allow-* and --deny-* flags for the same permission type in command-line arguments
🧯 If You Can't Patch
- Review all Deno scripts and ensure no contradictory permission flags are used
- Implement strict code review for Deno command-line arguments in CI/CD pipelines
🔍 How to Verify
Check if Vulnerable:
Check if running affected version: deno --version and compare to affected rangesCheck Version:
deno --versionVerify Fix Applied:
After update, test with: deno run --allow-read --deny-read -e "console.log('test')" should now properly deny read permission📡 Detection & Monitoring
Log Indicators:
- Deno processes running with both --allow-* and --deny-* flags for same permission
SIEM Query:
process.name:"deno" AND (command_line:"--allow-*" AND command_line:"--deny-*")🔗 References
- https://github.com/denoland/deno/commit/2f0fae9d9071dcaf0a689bc7097584b1b9ebc8db
- https://github.com/denoland/deno/commit/9d665572d3cd39f997e29e6daac7c1102fc5c04f
- https://github.com/denoland/deno/commit/ef315b56c26c9ef5f25284a5100d2ed525a148cf
- https://github.com/denoland/deno/pull/22894
- https://github.com/denoland/deno/pull/29213
- https://github.com/denoland/deno/security/advisories/GHSA-xqxc-x6p3-w683
- https://github.com/denoland/deno/security/advisories/GHSA-xqxc-x6p3-w683
