CVE-2025-61787

8.1 HIGH
Published: October 08, 2025 Modified: October 16, 2025

Description

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions prior to 2.5.3 and 2.2.15 are vulnerable to Command Line Injection attacks on Windows when batch files are executed. In Windows, ``CreateProcess()`` always implicitly spawns ``cmd.exe`` if a batch file (.bat, .cmd, etc.) is being executed even if the application does not specify it via the command line. This makes Deno vulnerable to a command injection attack on Windows. Versions 2.5.3 and 2.2.15 fix the issue.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
https://github.com/denoland/deno/pull/30818
Source: security-advisories@github.com
Issue Tracking Patch
https://github.com/denoland/deno/releases/tag/v2.2.15
Source: security-advisories@github.com
Release Notes
https://github.com/denoland/deno/releases/tag/v2.5.3
Source: security-advisories@github.com
Release Notes
https://github.com/denoland/deno/security/advisories/GHSA-m2gf-x3f6-8hq3
Source: security-advisories@github.com
Exploit Vendor Advisory

5 reference(s) from NVD

Quick Stats

CVSS v3 Score
8.1 / 10.0
EPSS (Exploit Probability)
0.5%
65th percentile
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)

Affected Vendors

deno microsoft