CVE-2025-48888: deno — Katalog CVE

csirt@kutim:~/threat-intel/cve/CVE-2025-48888

CVSS 5.3 · Medium EPSS 0,41%

Kerentanan Incorrect Authorization pada deno. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.41.3 and prior to versions 2.1.13, 2.2.13, and 2.3.2, `deno run --allow-read --deny-read main.ts` results in allowed, even though 'deny' should be stronger. The result is the same with all global unary permissions given as `--allow-* --deny-*`. This only affects a nonsensical combination of flags, so there shouldn't be a real impact on the userbase. Users may upgrade to version 2.1.13, 2.2.13, or 2.3.2 to receive a patch.

Rincian

Terbit di NVD: 4 Juni 2025
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-863: Incorrect Authorization
EPSS (30 hari): 0,41% peluang dieksploitasi; lebih tinggi dari 32,9% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
deno	deno	Versi 1.41.3 hingga sebelum 2.1.13
deno	deno	Versi 2.2.0 hingga sebelum 2.2.13
deno	deno	Versi 2.3.0 hingga sebelum 2.3.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/denoland/deno/security/advisories/GHSA-xqxc-x6p3-w683 exploit · advisory vendor
https://github.com/denoland/deno/commit/2f0fae9d9071dcaf0a689bc7097584b1b9ebc8db patch
https://github.com/denoland/deno/commit/9d665572d3cd39f997e29e6daac7c1102fc5c04f patch
https://github.com/denoland/deno/commit/ef315b56c26c9ef5f25284a5100d2ed525a148cf patch
https://github.com/denoland/deno/pull/22894 issue tracking · patch
https://github.com/denoland/deno/pull/29213 issue tracking · patch

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.