CVE-2025-61787

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-61787", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-09-30T19:43:49.903Z", "datePublished": "2025-10-08T00:59:17.322Z", "dateUpdated": "2025-10-08T18:51:09.772Z"}, "containers": {"cna": {"title": "Deno is Vulnerable to Command Injection on Windows During Batch File Execution", "problemTypes": [{"descriptions": [{"cweId": "CWE-77", "lang": "en", "description": "CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/denoland/deno/security/advisories/GHSA-m2gf-x3f6-8hq3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/denoland/deno/security/advisories/GHSA-m2gf-x3f6-8hq3"}, {"name": "https://github.com/denoland/deno/pull/30818", "tags": ["x_refsource_MISC"], "url": "https://github.com/denoland/deno/pull/30818"}, {"name": "https://github.com/denoland/deno/commit/8a0990ccd37bafd8768176ca64b906ba2da2d822", "tags": ["x_refsource_MISC"], "url": "https://github.com/denoland/deno/commit/8a0990ccd37bafd8768176ca64b906ba2da2d822"}, {"name": "https://github.com/denoland/deno/releases/tag/v2.2.15", "tags": ["x_refsource_MISC"], "url": "https://github.com/denoland/deno/releases/tag/v2.2.15"}, {"name": "https://github.com/denoland/deno/releases/tag/v2.5.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/denoland/deno/releases/tag/v2.5.3"}], "affected": [{"vendor": "denoland", "product": "deno", "versions": [{"version": ">= 2.3.0, < 2.5.3", "status": "affected"}, {"version": "< 2.2.15", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-08T00:59:17.322Z"}, "descriptions": [{"lang": "en", "value": "Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions prior to 2.5.3 and 2.2.15 are vulnerable to Command Line Injection attacks on Windows when batch files are executed. In Windows, ``CreateProcess()`` always implicitly spawns ``cmd.exe`` if a batch file (.bat, .cmd, etc.) is being executed even if the application does not specify it via the command line. This makes Deno vulnerable to a command injection attack on Windows. Versions 2.5.3 and 2.2.15 fix the issue."}], "source": {"advisory": "GHSA-m2gf-x3f6-8hq3", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-08T18:47:39.944579Z", "id": "CVE-2025-61787", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-08T18:51:09.772Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-61787", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-08T18:47:39.944579Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-08T18:49:14.928Z"}}], "cna": {"title": "Deno is Vulnerable to Command Injection on Windows During Batch File Execution", "source": {"advisory": "GHSA-m2gf-x3f6-8hq3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "denoland", "product": "deno", "versions": [{"status": "affected", "version": ">= 2.3.0, < 2.5.3"}, {"status": "affected", "version": "< 2.2.15"}]}], "references": [{"url": "https://github.com/denoland/deno/security/advisories/GHSA-m2gf-x3f6-8hq3", "name": "https://github.com/denoland/deno/security/advisories/GHSA-m2gf-x3f6-8hq3", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/denoland/deno/pull/30818", "name": "https://github.com/denoland/deno/pull/30818", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/denoland/deno/commit/8a0990ccd37bafd8768176ca64b906ba2da2d822", "name": "https://github.com/denoland/deno/commit/8a0990ccd37bafd8768176ca64b906ba2da2d822", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/denoland/deno/releases/tag/v2.2.15", "name": "https://github.com/denoland/deno/releases/tag/v2.2.15", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/denoland/deno/releases/tag/v2.5.3", "name": "https://github.com/denoland/deno/releases/tag/v2.5.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions prior to 2.5.3 and 2.2.15 are vulnerable to Command Line Injection attacks on Windows when batch files are executed. In Windows, ``CreateProcess()`` always implicitly spawns ``cmd.exe`` if a batch file (.bat, .cmd, etc.) is being executed even if the application does not specify it via the command line. This makes Deno vulnerable to a command injection attack on Windows. Versions 2.5.3 and 2.2.15 fix the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-77", "description": "CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-08T00:59:17.322Z"}}}, "cveMetadata": {"cveId": "CVE-2025-61787", "state": "PUBLISHED", "dateUpdated": "2025-10-08T18:51:09.772Z", "dateReserved": "2025-09-30T19:43:49.903Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-10-08T00:59:17.322Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "deno", "vendor": "denoland", "versions": [{"status": "affected", "version": ">= 2.3.0, < 2.5.3"}, {"status": "affected", "version": "< 2.2.15"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:*", "matchCriteriaId": "E75979F4-50DD-41E8-932A-C576F86DBFCF", "versionEndIncluding": "2.2.15", "vulnerable": true}, {"criteria": "cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:*", "matchCriteriaId": "7DD66938-204A-4542-BA86-274BB232C8C9", "versionEndExcluding": "2.5.3", "versionStartIncluding": "2.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions prior to 2.5.3 and 2.2.15 are vulnerable to Command Line Injection attacks on Windows when batch files are executed. In Windows, ``CreateProcess()`` always implicitly spawns ``cmd.exe`` if a batch file (.bat, .cmd, etc.) is being executed even if the application does not specify it via the command line. This makes Deno vulnerable to a command injection attack on Windows. Versions 2.5.3 and 2.2.15 fix the issue."}, {"lang": "es", "value": "Deno es un entorno de ejecuci\u00f3n de JavaScript, TypeScript y WebAssembly. Las versiones anteriores a la 2.5.3 y 2.2.15 son vulnerables a ataques de inyecci\u00f3n de l\u00ednea de comandos en Windows cuando se ejecutan archivos por lotes. En Windows, 'CreateProcess()' siempre genera impl\u00edcitamente 'cmd.exe' si se est\u00e1 ejecutando un archivo por lotes (.bat, .cmd, etc.), incluso si la aplicaci\u00f3n no lo especifica a trav\u00e9s de la l\u00ednea de comandos. Esto hace que Deno sea vulnerable a un ataque de inyecci\u00f3n de comandos en Windows. Las versiones 2.5.3 y 2.2.15 solucionan el problema."}], "id": "CVE-2025-61787", "lastModified": "2026-10-08T13:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-61787", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-10-08T18:47:39.944579Z", "version": "2.0.3"}}]}, "published": "2025-10-08T02:15:41.897", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/denoland/deno/commit/8a0990ccd37bafd8768176ca64b906ba2da2d822"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/denoland/deno/pull/30818"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/denoland/deno/releases/tag/v2.2.15"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/denoland/deno/releases/tag/v2.5.3"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/denoland/deno/security/advisories/GHSA-m2gf-x3f6-8hq3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-10-08T13:34:59.531244+00:00", "updated": "2025-10-08T13:34:59.531271+00:00", "vendors": ["deno", "deno$PRODUCT$deno", "microsoft", "microsoft$PRODUCT$windows"]}