VYPR
← All advisories
High severityNVD Advisory· Published Oct 8, 2025· Updated Oct 8, 2025

Deno is Vulnerable to Command Injection on Windows During Batch File Execution

CVE-2025-61787

Description

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions prior to 2.5.3 and 2.2.15 are vulnerable to Command Line Injection attacks on Windows when batch files are executed. In Windows, `CreateProcess() always implicitly spawns cmd.exe` if a batch file (.bat, .cmd, etc.) is being executed even if the application does not specify it via the command line. This makes Deno vulnerable to a command injection attack on Windows. Versions 2.5.3 and 2.2.15 fix the issue.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
denocrates.io
< 2.5.22.5.2

Affected products

1

Patches

1
8a0990ccd37b

fix: reject running `.bat` and `.cmd` directly on windows (#30818)

https://github.com/denoland/denoDivySep 24, 2025via ghsa
commit
2 files changed · +37 −0
  • ext/process/lib.rs+15 −0 modified
    @@ -752,6 +752,21 @@ fn compute_run_cmd_and_check_permissions(
       command: arg_cmd.to_string(),
       error: Box::new(e),
     })?;
+  #[cfg(windows)]
+  if let Some(ext) = cmd.extension()
+    && (ext == "bat" || ext == "cmd")
+  {
+    return Err(ProcessError::SpawnFailed {
+      command: arg_cmd.to_string(),
+      error: Box::new(
+        std::io::Error::new(
+          std::io::ErrorKind::PermissionDenied,
+          "Use a shell to execute .bat or .cmd files",
+        )
+        .into(),
+      ),
+    });
+  }
   check_run_permission(
     state,
     &RunQueryDescriptor::Path(
  • tests/unit/command_test.ts+22 −0 modified
    @@ -779,6 +779,28 @@ Deno.test(
   },
 );
 
+Deno.test(
+  {
+    permissions: { run: true, read: true, write: true },
+    ignore: Deno.build.os !== "windows",
+  },
+  async function rejectBatAndCmdFiles() {
+    const tempDir = await Deno.makeTempDir();
+    const fileName = tempDir + "/test.bat";
+    const file = await Deno.open(fileName, {
+      create: true,
+      write: true,
+    });
+
+    await assertRejects(async () => {
+      await new Deno.Command(fileName, {
+        args: ["&calc.exe"],
+      }).output();
+    }, Deno.errors.PermissionDenied);
+    file.close();
+  },
+);
+
 Deno.test(
   {
     permissions: { run: true, read: true },

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

8

News mentions

0

No linked articles in our index yet.