GitStock

denoland/deno · Security

Deno run with --allow-read and --deny-read flags results in allowed

GHSA ID
GHSA-xqxc-x6p3-w683
CVE ID
CVE-2025-48888
Severity
medium
Published
Updated
CVSS
5.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v3
5.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4
5.5 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

Description

Summary

deno run --allow-read --deny-read main.ts results in allowed, even though 'deny' should be stronger. Same with all global unary permissions given as --allow-* --deny-*.

Details

Caused by the fast exit logic in #22894.

PoC

Run the above command expecting no permissions to be passed.

Impact

This only affects a nonsensical combination of flags, so there shouldn't be a real impact on the userbase.

CWEs

  • CWE-863 · Incorrect Authorization

References

Open GitHub