Back to Database
Status published
Medium
CVE-2025-48935
Deno has --allow-read / --allow-write permission bypass in `node:sqlite`
Vulnerability Description
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 2.2.0 and prior to versions 2.2.5, it is possible to bypass Deno's permission read/write db permission check by using `ATTACH DATABASE` statement. Version 2.2.5 contains a patch for the issue.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-48935
Credits & Attribution
No credits recorded in the NVD database.
References
More from denoland
View All →CVE-2025-61787
Deno is Vulnerable to Command Injection on Windows During Batch File Execution
High
8.1
CVE-2025-61786
Deno's --deny-read check does not prevent permission bypass
Low
3.3
CVE-2025-61785
Deno's --deny-write check does not prevent permission bypass
Low
3.3
CVE-2025-55195
@std/toml Prototype Pollution in Node.js and Browser
High
7.3
CVE-2025-48934
Deno.env.toObject() ignores the variables listed in --deny-env and returns all environment variables
Medium
5.5
Affected Vendor
denoland
View all reports →Affected Software
deno
Vulnerable Versions:
>= 2.2.0, < 2.2.5
Timeline
Official Publish:
June 4th, 2025
Last Modified:
June 4th, 2025
Added to House:
July 22nd, 2026