CVE-2025-48935: 
Rust vulnerability analysis and mitigation

Deno, a JavaScript, TypeScript, and WebAssembly runtime, was found to contain a security vulnerability (CVE-2025-48935) that affects versions 2.2.0 through versions prior to 2.2.5. The vulnerability was disclosed on June 4, 2025, and allows attackers to bypass Deno's permission read/write db permission check using the ATTACH DATABASE statement (GitHub Advisory, NVD).

The vulnerability exists in Deno's node:sqlite implementation where the ATTACH DATABASE statement can be used to circumvent the runtime's permission system. The issue has been assigned a CVSS v4.0 score of 5.5 (MEDIUM) with the vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P. The vulnerability is classified as CWE-863 (Incorrect Authorization) (Wiz).

The vulnerability allows attackers to bypass Deno's security permissions system, specifically the read/write database permissions. This could enable unauthorized access to or modification of database files that should be restricted by the permission system (Wiz).

The vulnerability has been patched in Deno version 2.2.5. The fix includes restrictions on the ATTACH DATABASE statement and sets the SQLITELIMITATTACHED to 0 to prevent this type of bypass. Users should upgrade to version 2.2.5 or later to receive the fix (Deno Commit).