PT-2025-41208 · Deno · Deno

Dellalibera · Published 2025-10-07 · Updated 2026-04-14 · CVE-2025-61785

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Deno versions prior to 2.5.3 Deno versions prior to 2.2.15

Description Deno is a JavaScript, TypeScript, and WebAssembly runtime. The Deno.FsFile.prototype.utime and Deno.FsFile.prototype.utimeSync functions are not limited by the --deny-write=./ permission model check in versions prior to 2.5.3 and 2.2.15. This allows modification of file access (atime) and modification (mtime) times even when the file is opened with read-only permissions and write operations are disallowed. While APIs like Deno.utime and Deno.utimeSync require allow-write permission, this bypass is possible when a file is opened with read-only flags and deny-write permission is set.

Recommendations Update to Deno version 2.5.3 or later. Update to Deno version 2.2.15 or later.

Exploit

Fix

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

Related Identifiers

CVE-2025-61785

GHSA-VG2R-RMGP-CGQJ

JLSEC-2026-111

Affected Products

Deno

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61785.json · Exploit
• https://github.com/denoland/deno/security/advisories/GHSA-vg2r-rmgp-cgqj · Vendor Advisory
• https://github.com/denoland/deno/pull/30872 · Patch
• https://github.com/denoland/deno/commit/992e998dfe436cdc9325232759af8be92f11739b · Patch
• https://osv.dev/vulnerability/JLSEC-2026-111 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vg2r-rmgp-cgqj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-61785 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61785 · Security Note
• https://github.com/denoland/deno · Note
• https://github.com/denoland/deno/releases/tag/v2.2.15 · Note
• https://github.com/denoland/deno/releases/tag/v2.5.3 · Note
• https://twitter.com/CVEnew/status/1975763503471296629 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1o120p5/resumen_diario_de_vulnerabilidades_08102025 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1o28ww8/resumen_diario_de_vulnerabilidades_09102025 · Reddit Post
• https://github.com/advisories/GHSA-vg2r-rmgp-cgqj · Note