CVE-2025-61787
HIGHDeno < 2.2.15 and 2.3.0-2.5.2 - Command Injection via Windows Batch File Execution
Title source: llmDescription
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions prior to 2.5.3 and 2.2.15 are vulnerable to Command Line Injection attacks on Windows when batch files are executed. In Windows, ``CreateProcess()`` always implicitly spawns ``cmd.exe`` if a batch file (.bat, .cmd, etc.) is being executed even if the application does not specify it via the command line. This makes Deno vulnerable to a command injection attack on Windows. Versions 2.5.3 and 2.2.15 fix the issue.
References (5)
Core 5
Core References
Exploit, Vendor Advisory x_refsource_confirm
https://github.com/denoland/deno/security/advisories/GHSA-m2gf-x3f6-8hq3
Issue Tracking, Patch x_refsource_misc
https://github.com/denoland/deno/pull/30818
Patch x_refsource_misc
https://github.com/denoland/deno/commit/8a0990ccd37bafd8768176ca64b906ba2da2d822
Release Notes x_refsource_misc
https://github.com/denoland/deno/releases/tag/v2.2.15
Release Notes x_refsource_misc
https://github.com/denoland/deno/releases/tag/v2.5.3
Scores
CVSS v3
8.1
EPSS
0.0211
EPSS Percentile
79.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
total
Details
CWE
CWE-77
Status
published
Products (2)
crates.io/deno
0 - 2.5.2crates.io
deno/deno
< 2.2.15
Published
Oct 08, 2025
Tracked Since
Feb 18, 2026