UpHeron
All vulnerabilities

Servers and applications

CVE-2025-48935

--allow-read / --allow-write permission bypass in `node:sqlite`

Severity
Medium 5.5
Published
3 Jun 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.2.5
Also known as
GHSA-8vxj-4cph-c596
Sources
NVD, Project advisories (GitHub)

Description

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 2.2.0 and prior to versions 2.2.5, it is possible to bypass Deno's permission read/write db permission check by using `ATTACH DATABASE` statement. Version 2.2.5 contains a patch for the issue.

Affected software

SoftwareAffected versions
DenoServers and applications · cpe:a:deno:deno
  • From 2.2.0 before 2.2.5
DenoServers and applications · github:denoland/deno
  • From 2.2.0 before 2.2.5

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-48935
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-48935
  • GitHub Advisory Database https://github.com/advisories/GHSA-8vxj-4cph-c596
  • github.com https://github.com/denoland/deno/security/advisories/GHSA-8vxj-4cph-c596