CVE-2025-48888: Deno Privilege Escalation Vulnerability

CVE-2025-48888 Overview

CVE-2025-48888 is an authorization flaw in Deno, a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.41.3 and prior to versions 2.1.13, 2.2.13, and 2.3.2, Deno mishandles contradictory global permission flags. When a user runs deno run --allow-read --deny-read main.ts, the runtime treats the operation as allowed, even though --deny-* flags should override --allow-* flags. The same behavior applies to all global unary permission pairs specified as --allow-* --deny-*. The issue is tracked as CWE-863: Incorrect Authorization.

Critical Impact
Contradictory global permission flags resolve to allow, weakening the intended sandbox model. The vendor notes the flag combination is nonsensical, so real-world impact on the userbase is limited.

Affected Products

Deno versions 1.41.3 through 2.1.12
Deno versions 2.2.0 through 2.2.12
Deno versions 2.3.0 through 2.3.1

Discovery Timeline

2025-06-04 - CVE-2025-48888 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-48888

Vulnerability Analysis

Deno enforces a permission model that restricts runtime access to sensitive resources such as file system reads, network calls, and environment variables. Users grant capabilities using --allow-* flags and revoke them using --deny-* flags. The security model documents that deny takes precedence over allow.

The vulnerability breaks this precedence rule for global unary permissions. The is_allow_all check in runtime/permissions/lib.rs evaluates the granted_global state and per-item deny lists but omits the flag_denied_global and prompt_denied_global fields. When both flags are supplied globally, the runtime returns true for allow-all and bypasses the deny directive.

Root Cause

The root cause is an incomplete authorization check [CWE-863] in the permission resolver. The is_allow_all method omitted two boolean fields tracking global deny states, so contradictory global flags were resolved in favor of the allow directive rather than the deny directive.

Attack Vector

Exploitation requires a user to launch Deno with contradictory global permission flags. An attacker who controls the command line, a script wrapper, or a task runner configuration could inject an --allow-* flag alongside an intended --deny-* flag to widen the sandbox. The vendor states the flag combination is nonsensical and unlikely to appear in practice.

rust

  pub fn is_allow_all(&self) -> bool {
    self.granted_global
+     && !self.flag_denied_global
+     && !self.prompt_denied_global
      && self.flag_denied_list.is_empty()
      && self.prompt_denied_list.is_empty()
  }

Source: denoland/deno commit 2f0fae9. The patch adds the missing flag_denied_global and prompt_denied_global checks so global deny flags correctly suppress allow-all resolution.

Detection Methods for CVE-2025-48888

Indicators of Compromise

Deno process invocations that combine --allow-* and --deny-* flags for the same permission category in shell history, CI logs, or container manifests.
Deno runtime versions in the vulnerable ranges (1.41.3 through 2.1.12, 2.2.0 through 2.2.12, and 2.3.0 through 2.3.1) present on developer or build systems.

Detection Strategies

Parse command lines of deno and deno run invocations and flag any that pair --allow-* with --deny-* for the same resource such as read, write, net, or env.
Inventory Deno binaries via deno --version across build agents, developer laptops, and container images to identify unpatched installations.
Review task definitions in deno.json, Makefile, package.json scripts, and CI pipeline files for contradictory permission flag usage.

Monitoring Recommendations

Ingest process execution telemetry into a data lake or SIEM and alert on deno command lines containing both allow and deny variants of the same permission.
Track Deno version upgrades across the fleet and generate exceptions when hosts remain on affected versions after the patch release.

How to Mitigate CVE-2025-48888

Immediate Actions Required

Upgrade Deno to version 2.1.13, 2.2.13, or 2.3.2 on all developer workstations, servers, and CI runners.
Audit shell scripts, Dockerfiles, and CI configurations for deno invocations that combine --allow-* and --deny-* for the same resource and remove the redundant flag.
Rebuild container images that ship Deno so downstream deployments consume patched binaries.

Patch Information

The fix landed in pull request #29213 and is available in Deno 2.1.13, 2.2.13, and 2.3.2. See the GitHub Security Advisory GHSA-xqxc-x6p3-w683 for full advisory details. The patch adds flag_denied_global and prompt_denied_global to the is_allow_all evaluation in runtime/permissions/lib.rs.

Workarounds

Avoid combining --allow-* with --deny-* global flags for the same permission category, and use only the --deny-* flag when the intent is to prohibit an operation.
Prefer scoped permission grants such as --allow-read=/tmp over global --allow-read to reduce the impact of any residual permission logic errors.

bash

# Upgrade Deno to a patched version
deno upgrade --version 2.3.2

# Verify the installed runtime
deno --version

# Preferred: use only the deny flag or scoped allow
deno run --deny-read main.ts
deno run --allow-read=/var/data main.ts