CVE-2025-61787: 
Rust vulnerability analysis and mitigation

Deno, a JavaScript, TypeScript, and WebAssembly runtime, was found to be vulnerable to Command Line Injection attacks (CVE-2025-61787) on Windows systems. The vulnerability affects versions prior to 2.5.3 and 2.2.15, discovered in October 2025. The issue stems from Windows' CreateProcess() behavior, which implicitly spawns cmd.exe when executing batch files (.bat, .cmd), even if not explicitly specified via command line (NVD, Security Online).

The vulnerability has been assigned a CVSS v3.1 base score of 8.1 (High), with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The flaw is categorized as CWE-77 (Improper Neutralization of Special Elements used in a Command). The vulnerability can be triggered when batch files are executed through Deno's process APIs, where the Windows subsystem automatically routes the execution through the command interpreter (cmd.exe), potentially allowing command injection if user-supplied arguments are passed to the script (GitHub Advisory).

The vulnerability allows attackers to execute arbitrary commands when batch files are spawned under certain conditions on Windows systems. This could lead to unauthorized command execution outside the intended execution context, potentially compromising system security. The impact is particularly significant in environments where Deno is used to automate or orchestrate scripts on Windows systems (Security Online).

The vulnerability has been patched in Deno versions 2.2.15 (backported security fix) and 2.5.3 (latest stable release). Users are strongly advised to upgrade to one of these patched versions to mitigate the security risk. The fix involves rejecting direct execution of .bat and .cmd files on Windows systems (GitHub Release, GitHub Release).

The security fix has received positive community feedback, with numerous developers acknowledging the importance of the patch. However, some users have noted that this represents a breaking change as it affects existing code that executes .bat and .cmd files on Windows (GitHub PR).