~ / search / GHSA-xqxc-x6p3-w683

GHSA-xqxc-x6p3-w683

Deno run with --allow-read and --deny-read flags results in allowed

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-48888

Packages

EcosystemPackageAffectedFixed in
crates.io deno >= 1.41.3, < 2.1.13 2.1.13
crates.io deno >= 2.2.0, < 2.2.13 2.2.13
crates.io deno >= 2.3.0, < 2.3.2 2.3.2
crates.io deno_runtime >= 0.150.0, < 0.212.0 0.212.0

Details

As written in the advisory (Markdown source, shown as plain text).

### Summary `deno run --allow-read --deny-read main.ts` results in allowed, even though 'deny' should be stronger. Same with all global unary permissions given as `--allow-* --deny-*`. ### Details Caused by the fast exit logic in #22894. ### PoC Run the above command expecting no permissions to be passed. ### Impact This only affects a nonsensical combination of flags, so there shouldn't be a real impact on the userbase.

References

External links from the advisory. They lead to third-party sites.