CVE-2025-61787
Published: 08 October 2025
Summary
CVE-2025-61787 is a high-severity Command Injection (CWE-77) vulnerability in Deno Deno. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 34.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Mandates timely identification, reporting, and correction of flaws, directly addressing the need to patch vulnerable Deno versions prior to 2.5.3 or 2.2.15 to eliminate the command injection vulnerability.
Requires validation of information inputs at system entry points, preventing command injection attacks by sanitizing inputs used in Deno batch file executions on Windows.
Provides vulnerability scanning to identify systems running vulnerable Deno versions affected by the Windows-specific command injection issue, enabling proactive remediation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables remote exploitation of a public-facing Deno application (T1190) leading to command injection and arbitrary execution via Windows Command Shell (cmd.exe, T1059.003).
NVD Description
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions prior to 2.5.3 and 2.2.15 are vulnerable to Command Line Injection attacks on Windows when batch files are executed. In Windows, ``CreateProcess()`` always implicitly spawns ``cmd.exe`` if a batch file (.bat,…
more
.cmd, etc.) is being executed even if the application does not specify it via the command line. This makes Deno vulnerable to a command injection attack on Windows. Versions 2.5.3 and 2.2.15 fix the issue.
Deeper analysisAI
CVE-2025-61787 is a command line injection vulnerability (CWE-77) affecting Deno, a JavaScript, TypeScript, and WebAssembly runtime. Versions prior to 2.5.3 and 2.2.15 are vulnerable on Windows systems specifically when batch files (.bat, .cmd, etc.) are executed. The issue stems from the Windows CreateProcess() API, which implicitly spawns cmd.exe for batch file execution regardless of whether the application specifies it, enabling command injection attacks in Deno. The vulnerability carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Attackers can exploit this vulnerability remotely over the network without privileges or user interaction, though it requires high attack complexity. Exploitation occurs when Deno processes a maliciously crafted batch file, allowing injection of arbitrary commands via cmd.exe. Successful attacks can result in high-impact confidentiality, integrity, and availability violations, potentially enabling full system compromise on affected Windows hosts running vulnerable Deno versions.
Deno advisories and release notes recommend upgrading to version 2.5.3 or 2.2.15, which address the issue through targeted fixes documented in the associated GitHub commit, pull request, and security advisory. No additional workarounds are specified beyond applying these patches.
Details
- CWE(s)