cve.bz

CVE-2025-48888

5.5 mediumEPSS 0.4%

Medium (5.5) in deno deno. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in deno 2.1.13, 2.2.13, 2.3.2.

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.41.3 and prior to versions 2.1.13, 2.2.13, and 2.3.2, `deno run --allow-read --deny-read main.ts` results in allowed, even though 'deny' should be stronger. The result is the same with all global unary permissions given as `--allow-* --deny-*`. This only affects a nonsensical combination of flags, so there shouldn't be a real impact on the userbase. Users may upgrade to version 2.1.13, 2.2.13, or 2.3.2 to receive a patch.

Severity

CVSS 4.0

5.5 medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

CVSS 3.1

5.3 medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS
0.4% chance of exploitation in the next 30 days; higher than 36% of CVEs (scores of 2026-10-31)
CWE
CWE-863
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-xqxc-x6p3-w683crates.iodeno>=1.41.3 <2.1.132.1.13
GHSA-xqxc-x6p3-w683crates.iodeno>=2.2.0 <2.2.132.2.13
GHSA-xqxc-x6p3-w683crates.iodeno>=2.3.0 <2.3.22.3.2
GHSA-xqxc-x6p3-w683crates.iodeno_runtime>=0.150.0 <0.212.00.212.0

References

Check your stackJSON