CVE-2025-61787: deno Command Injection
Vulnerability summary
CVE-2025-61787 is a high (CVSS 8.1) Command Injection vulnerability in deno. EPSS estimates a 2.08% chance of exploitation in the next 30 days, higher than 81.2% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 08-10-2025PublishedVulnerability first disclosed.
- 08-10-2025Last modifiedVulnerability information updated.
Description
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions prior to 2.5.3 and 2.2.15 are vulnerable to Command Line Injection attacks on Windows when batch files are executed. In Windows, ``CreateProcess()`` always implicitly spawns ``cmd.exe`` if a batch file (.bat, .cmd, etc.) is being executed even if the application does not specify it via the command line. This makes Deno vulnerable to a command injection attack on Windows. Versions 2.5.3 and 2.2.15 fix the issue.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · Crates.ioEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
2.08%
Chance of exploitation in the next 30 days
Percentile
81%
Versus all other CVEs
30-day change
0.00 pp
From 2.08% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundDeno
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Crates.Io1 product
- deno< 2.5.2
Deno1 product
- deno≤ 2.2.15 | ≥ 2.3.0, < 2.5.3
Denoland1 product
- deno≥ 2.3.0, < 2.5.3 | < 2.2.15
3 vendors · 3 products
References
8 links- github.com/denoland/deno/security/advisories/GHSA-m2gf-x3f6-8hq3X Refsource CONFIRMWEBExploitVendor Advisory
- github.com/denoland/denoPACKAGE