CVE-2025-61787

HighCVSS 8.1/10Last modified Oct 8, 2026

Description

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions prior to 2.5.3 and 2.2.15 are vulnerable to Command Line Injection attacks on Windows when batch files are executed. In Windows, ``CreateProcess()`` always implicitly spawns ``cmd.exe`` if a batch file (.bat, .cmd, etc.) is being executed even if the application does not specify it via the command line. This makes Deno vulnerable to a command injection attack on Windows. Versions 2.5.3 and 2.2.15 fix the issue.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
denoland	deno	>= 2.3.0, < 2.5.3; < 2.2.15

References

https://github.com/denoland/deno/commit/8a0990ccd37bafd8768176ca64b906ba2da2d822Patch
https://github.com/denoland/deno/pull/30818Issue Tracking, Patch
https://github.com/denoland/deno/releases/tag/v2.2.15Release Notes
https://github.com/denoland/deno/releases/tag/v2.5.3Release Notes
https://github.com/denoland/deno/security/advisories/GHSA-m2gf-x3f6-8hq3Exploit, Vendor Advisory

Timeline

Published: Oct 8, 2025
Last modified: Oct 8, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-617885.4Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 17.8 and 18.2, CVE-2025-617896.5Icinga DB Web provides a graphical interface for Icinga monitoring. Before 1.1.4 and 1.2.3, an authorized user with access to Icinga DB Web,CVE-2025-61799.8Permissions Bypass in Extension Management in Google ChromeOS 16181.27.0 on managed Chrome devices allows a local attacker to disabl CVE-2025-617926.4Quadient DS-700 iQ devices through 2025-09-30 might have a race condition during the quick clicking of (in order) the Question Mark button, CVE-2025-617955.3Improper Resource Shutdown or Release vulnerability in Apache Tomcat. If an error occurred (including exceeding limits) during the processi CVE-2025-617965.4Adobe Experience Manager versions 11.6 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by CVE-2025-617975.4Adobe Experience Manager versions 11.6 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by CVE-2025-617987.8Dimension versions 4.1.4 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in CVE-2025-617997.8Dimension versions 4.1.4 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in CVE-2025-61808.5The StrongDM Client insufficiently protected a pre-authentication token. Attackers could exploit this to intercept and reuse the token, pote CVE-2025-618007.8Dimension versions 4.1.4 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code exe CVE-2025-618017.8Dimension versions 4.1.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the con