CVE-2025-48888 Deno run with --allow-read and --deny-read flags results in allowed

What is CVE-2025-48888?

CVE-2025-48888 is a medium-severity vulnerability in denoland deno, published on 4 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.41.3 and prior to versions 2.1.13, 2.2.13, and 2.3.2, `deno run --allow-read --deny-read main.ts` results in allowed, even though 'deny' should be stronger. The result is the same with all global unary permissions given as `--allow-* --deny-*`. This only affects a nonsensical combination of flags, so there shouldn't be a real impact on the userbase. Users may upgrade to version 2.1.13, 2.2.13, or 2.3.2 to receive a patch.

Weakness: CWE-863

Which versions are affected by CVE-2025-48888?

8 open source packages ship an affected version, including deno and deno_runtime. It affects 1 product.

Products include Deno Deno.

How do I fix CVE-2025-48888?

Upgrade deno to a fixed version for your release line: 2.1.13, 2.2.13 or 2.3.2.

Is CVE-2025-48888 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-48888 exists.

Other vulnerabilities in denoland deno

• CVE-2023-28445 Deno improperly handles resizable ArrayBuffer Critical 10.0
• CVE-2022-24783 Sandbox bypass leading to arbitrary code execution in Deno Critical 10.0
• CVE-2021-32619 Static imports inside dynamically imported modules do not adhere to permission checks Critical 9.8
• CVE-2026-22863 Deno node:crypto doesn't finalize cipher Critical 9.2
• CVE-2024-27936 Deno interactive permission prompt spoofing via improper ANSI stripping High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xqxc-x6p3-w683, JLSEC-2026-109.