CVE-2025-61787highCWE-77

CVE-2025-61787: falha de alta gravidade em denoland deno

Deno is Vulnerable to Command Injection on Windows During Batch File Execution

Publicada em

Seguir esta CVE+ Monitorar deno+ Monitorar deno

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.1epss 2.1%
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions prior to 2.5.3 and 2.2.15 are vulnerable to Command Line Injection attacks on Windows when batch files are executed. In Windows, ``CreateProcess()`` always implicitly spawns ``cmd.exe`` if a batch file (.bat, .cmd, etc.) is being executed even if the application does not specify it via the command line. This makes Deno vulnerable to a command injection attack on Windows. Versions 2.5.3 and 2.2.15 fix the issue.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
denoland · deno
CVEs relacionadas — denoland deno

No mesmo produto, das mais perigosas para as menos.

CVE-2026-27190HIGHDeno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_processEPSS 2.5%CVE-2024-27933HIGHDeno arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypassEPSS 2.3%CVE-2026-32260HIGHCommand Injection via incomplete shell metacharacter blocklist in node:child_process (bypass of CVE-2026-27190 fix)EPSS 1.6%CVE-2026-103473CRITICALDeno 2.7.0 through 2.9.7 Command Injection via node:child_processEPSS 1.5%CVE-2022-24783CRITICALSandbox bypass leading to arbitrary code execution in DenoEPSS 1.1%CVE-2023-28446HIGHDeno is vulnerable to interactive `run` permission prompt spoofing via improper ANSI neutralizationEPSS 1.1%