PT-2025-23841 · Deno · Deno

Frankvd · Published 2025-06-04 · Updated 2026-04-14 · CVE-2025-48934

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Deno versions prior to 2.1.13 and prior to 2.2.13

Description The issue affects Deno, a JavaScript, TypeScript, and WebAssembly runtime. It involves the Deno.env.toObject method, which ignores variables listed in the --deny-env option of the deno run command. This could lead to a false impression that variables listed in the option are impossible to read, making software relying on this combination vulnerable to malicious code trying to steal secrets.

Recommendations For Deno versions prior to 2.1.13, update to version 2.1.13 or later. For Deno versions prior to 2.2.13, update to version 2.2.13 or later. As a temporary workaround, consider restricting access to sensitive environment variables until the patch is applied.

Exploit

Fix

Weakness Enumeration

CWE-201

Related Identifiers

CVE-2025-48934

GHSA-7W8P-CHXQ-2789

JLSEC-2026-110

Affected Products

Deno

References · 16

• 🔥 https://github.com/denoland/deno/security/advisories/GHSA-7w8p-chxq-2789 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48934.json · Exploit
• https://github.com/denoland/deno/commit/946ccda1aa19a00c478a5e6826b75053b050d753 · Patch
• https://github.com/denoland/deno/commit/2959e083912420988066a001c2b2d6732a1b562f · Patch
• https://github.com/denoland/deno/pull/29079 · Patch
• https://osv.dev/vulnerability/CVE-2025-48934 · Vendor Advisory
• https://osv.dev/vulnerability/JLSEC-2026-110 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7w8p-chxq-2789 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48934 · Security Note
• https://github.com/denoland/deno · Note
• https://docs.deno.com/runtime/fundamentals/security/#environment-variables · Note
• https://twitter.com/CVEnew/status/1930347888908845503 · Twitter Post
• https://github.com/advisories/GHSA-7w8p-chxq-2789 · Note
• https://t.me/cvenotify/127380 · Telegram Post
• https://t.me/cvetracker/25440 · Telegram Post