CVE-2025-48934

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-48934
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to versions 2.1.13 and 2.2.13, the `Deno.env.toObject` method ignores any variables listed in the `--deny-env` option of the `deno run` command. When looking at the documentation of the `--deny-env` option this might lead to a false impression that variables listed in the option are impossible to read. Software relying on the combination of both flags to allow access to most environment variables except a few sensitive ones will be vulnerable to malicious code trying to steal secrets using the `Deno.env.toObject()` method. Versions 2.1.13 and 2.2.13 contains a patch.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://docs.deno.com/api/deno/~/Deno.Env.toObject Product
https://docs.deno.com/runtime/fundamentals/security/#environment-variables Product
https://github.com/denoland/deno/commit/2959e083912420988066a001c2b2d6732a1b562f Patch
https://github.com/denoland/deno/commit/946ccda1aa19a00c478a5e6826b75053b050d753 Patch
https://github.com/denoland/deno/pull/29079 Issue Tracking Patch
https://github.com/denoland/deno/security/advisories/GHSA-7w8p-chxq-2789 Exploit Vendor Advisory
https://github.com/denoland/deno/security/advisories/GHSA-7w8p-chxq-2789 Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:*
cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:*
History

02 Jul 2025, 13:43

Type Values Removed Values Added
First Time Deno deno
Deno
References () https://docs.deno.com/api/deno/~/Deno.Env.toObject - () https://docs.deno.com/api/deno/~/Deno.Env.toObject - Product
References () https://docs.deno.com/runtime/fundamentals/security/#environment-variables - () https://docs.deno.com/runtime/fundamentals/security/#environment-variables - Product
References () https://github.com/denoland/deno/commit/2959e083912420988066a001c2b2d6732a1b562f - () https://github.com/denoland/deno/commit/2959e083912420988066a001c2b2d6732a1b562f - Patch
References () https://github.com/denoland/deno/commit/946ccda1aa19a00c478a5e6826b75053b050d753 - () https://github.com/denoland/deno/commit/946ccda1aa19a00c478a5e6826b75053b050d753 - Patch
References () https://github.com/denoland/deno/pull/29079 - () https://github.com/denoland/deno/pull/29079 - Issue Tracking, Patch
References () https://github.com/denoland/deno/security/advisories/GHSA-7w8p-chxq-2789 - () https://github.com/denoland/deno/security/advisories/GHSA-7w8p-chxq-2789 - Exploit, Vendor Advisory
CPE cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.3

05 Jun 2025, 20:12

Type Values Removed Values Added
Summary
  • (es) Deno es un entorno de ejecución de JavaScript, TypeScript y WebAssembly. En versiones anteriores a la 2.1.13 y la 2.2.13, el método `Deno.env.toObject` ignora las variables listadas en la opción `--deny-env` del comando `deno run`. Al consultar la documentación de la opción `--deny-env`, esto podría dar la falsa impresión de que las variables listadas en ella son imposibles de leer. El software que utiliza la combinación de ambos indicadores para acceder a la mayoría de las variables de entorno, excepto algunas sensibles, será vulnerable a código malicioso que intente robar secretos mediante el método `Deno.env.toObject()`. Las versiones 2.1.13 y 2.2.13 contienen un parche.

04 Jun 2025, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-06-04 20:15

Updated : 2025-07-02 13:43

NVD link : CVE-2025-48934

Mitre link : CVE-2025-48934

CVE.ORG link : CVE-2025-48934

JSON object : View

Products Affected

deno

  • deno
CWE
CWE-201

Insertion of Sensitive Information Into Sent Data