CVE-2025-61787

08.10.2025, 02:15

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions prior to 2.5.3 and 2.2.15 are vulnerable to Command Line Injection attacks on Windows when batch files are executed. In Windows, ``CreateProcess()`` always implicitly spawns ``cmd.exe`` if a batch file (.bat, .cmd, etc.) is being executed even if the application does not specify it via the command line. This makes Deno vulnerable to a command injection attack on Windows. Versions 2.5.3 and 2.2.15 fix the issue.

Command Injection

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	8.1 HIGH	NETWORK	HIGH	NONE	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub_M	CNA	8.1 HIGH	NETWORK	HIGH	NONE	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA-ADP	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 64%

Vendor	Product	Version
deno	deno	𝑥 ≤ 2.2.15
deno	deno	2.3.0 ≤ 𝑥 < 2.5.3

𝑥

= Vulnerable software versions

Known Exploits!

https://github.com/denoland/deno/security/advisories/GHSA-m2gf-x3f6-8hq3

Common Weakness Enumeration

CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
The software constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

References

https://github.com/denoland/deno/commit/8a0990ccd37bafd8768176ca64b906ba2da2d822

https://github.com/denoland/deno/pull/30818

https://github.com/denoland/deno/releases/tag/v2.2.15

https://github.com/denoland/deno/releases/tag/v2.5.3

https://github.com/denoland/deno/security/advisories/GHSA-m2gf-x3f6-8hq3