CVE-2025-61787
📋 TL;DR
This CVE describes a command injection vulnerability in Deno on Windows systems. When Deno executes batch files (.bat, .cmd) on Windows, the underlying CreateProcess() function implicitly spawns cmd.exe, allowing attackers to inject arbitrary commands. This affects Deno users on Windows who execute batch files through Deno's APIs.
💻 Affected Systems
- Deno
📦 What is this software?
Deno by Deno
Deno by Deno
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with arbitrary command execution as the Deno process user, potentially leading to data theft, ransomware deployment, or complete system takeover.
Likely Case
Limited command execution within the Deno process context, potentially allowing file system access, data exfiltration, or lateral movement within the network.
If Mitigated
No impact if proper input validation and sandboxing are implemented, or if batch file execution is avoided.
🎯 Exploit Status
Exploitation requires the ability to control or influence batch file execution through Deno APIs. The vulnerability is in the Windows CreateProcess() behavior when handling batch files.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.5.3 or 2.2.15
Vendor Advisory: https://github.com/denoland/deno/security/advisories/GHSA-m2gf-x3f6-8hq3
Restart Required: Yes
Instructions:
1. Check current Deno version with 'deno --version'. 2. Update to Deno 2.5.3 or 2.2.15 using 'deno upgrade --version 2.5.3' or 'deno upgrade --version 2.2.15'. 3. Restart all Deno processes and applications.
🔧 Temporary Workarounds
Avoid batch file execution
windowsPrevent Deno from executing batch files by modifying application code to avoid batch file execution APIs.
Implement input validation
allAdd strict input validation and sanitization for any user-controlled parameters passed to Deno's execution APIs.
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all user inputs that could affect batch file execution
- Run Deno processes with minimal privileges and in isolated environments/sandboxes
🔍 How to Verify
Check if Vulnerable:
Check if Deno version is below 2.5.3 or 2.2.15 on Windows systemsCheck Version:
deno --versionVerify Fix Applied:
Verify Deno version is 2.5.3 or 2.2.15 or higher📡 Detection & Monitoring
Log Indicators:
- Unexpected cmd.exe spawns from Deno processes
- Unusual batch file execution patterns
- Deno process spawning unexpected child processes
Network Indicators:
- Outbound connections from Deno processes to unexpected destinations
- Command and control traffic patterns
SIEM Query:
Process creation where parent_process contains 'deno' and process contains 'cmd.exe'🔗 References
- https://github.com/denoland/deno/commit/8a0990ccd37bafd8768176ca64b906ba2da2d822
- https://github.com/denoland/deno/pull/30818
- https://github.com/denoland/deno/releases/tag/v2.2.15
- https://github.com/denoland/deno/releases/tag/v2.5.3
- https://github.com/denoland/deno/security/advisories/GHSA-m2gf-x3f6-8hq3
