CVE-2025-61785 Deno's --deny-write check does not prevent permission bypass
Attackers can bypass Deno's write permission restrictions to modify file timestamps using specific file stream APIs.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-61785?
CVE-2025-61785 is a low-severity vulnerability in denoland deno, published on 8 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Deno is a JavaScript, TypeScript, and WebAssembly runtime. In versions prior to 2.5.3 and 2.2.15, `Deno.FsFile.prototype.utime` and `Deno.FsFile.prototype.utimeSync` are not limited by the permission model check `--deny-write=./`. It's possible to change to change the access (`atime`) and modification (`mtime`) times on the file stream resource even when the file is opened with `read` only permission (and `write`: `false`) and file write operations are not allowed (the script is executed with `--deny-write=./`). Similar APIs like `Deno.utime` and `Deno.utimeSync` require `allow-write` permission, however, when a file is opened, even with read only flags and deny-write permission, it's still possible to change the access (`atime`) and modification (`mtime`) times, and thus bypass the permission model. Versions 2.5.3 and 2.2.15 fix the issue.
Weakness: CWE-266
Which versions are affected by CVE-2025-61785?
2 open source packages ship an affected version, including deno. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
deno crates.io | All versions | 2.5.3 |
deno crates.io | All versions | 2.5.3 |
Products include Deno Deno.
How do I fix CVE-2025-61785?
Upgrade deno to 2.5.3 or later.
Is CVE-2025-61785 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-61785 exists.
Other vulnerabilities in denoland deno
- CVE-2023-28445 Deno improperly handles resizable ArrayBuffer
- CVE-2022-24783 Sandbox bypass leading to arbitrary code execution in Deno
- CVE-2021-32619 Static imports inside dynamically imported modules do not adhere to permission checks
- CVE-2026-22863 Deno node:crypto doesn't finalize cipher
- CVE-2024-27936 Deno interactive permission prompt spoofing via improper ANSI stripping
Sources
Also known as GHSA-vg2r-rmgp-cgqj, JLSEC-2026-111.