CVE-2025-61787CWE-77command-injection

CVE-2025-61787

High · published October 8, 2025

CVSS v3.1
8.1
EPSS
2%
Percentile
81.4
In the wild
Unconfirmed
What it is

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions prior to 2.5.3 and 2.2.15 are vulnerable to Command Line Injection attacks on Windows when batch files are executed. In Windows, ``CreateProcess()`` always implicitly spawns ``cmd.exe`` if a batch file (.bat, .cmd, etc.) is being executed even if the application does not specify it via the command line. This makes Deno vulnerable to a command injection attack on Windows. Versions 2.5.3 and 2.2.15 fix the issue.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02084 · 81.4th percentile
Weakness
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2025-10-08T06:15Z
Affected products (2)
ProductVersionsFixed in
deno/deno≤ 2.2.15—
deno/deno≥ 2.3.0, < 2.5.32.5.3
References (5)
https://github.com/denoland/deno/commit/8a0990ccd37bafd8768176ca64b906ba2da2d822 · [email protected]https://github.com/denoland/deno/pull/30818 · [email protected]https://github.com/denoland/deno/releases/tag/v2.2.15 · [email protected]https://github.com/denoland/deno/releases/tag/v2.5.3 · [email protected]https://github.com/denoland/deno/security/advisories/GHSA-m2gf-x3f6-8hq3 · [email protected]
EPSS history
Timeline
  • 08 OCT 00:59Z
    Deno is Vulnerable to Command Injection on Windows During Batch File Execution
    cvelistv5