5.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-48888

CVE-2025-48888: Deno run with --allow-read and --deny-read flags results in allowed

Summary

deno run --allow-read --deny-read main.ts results in allowed, even though 'deny' should be stronger. Same with all global unary permissions given as --allow-* --deny-*.

Details

Caused by the fast exit logic in #22894.

PoC

Run the above command expecting no permissions to be passed.

Impact

This only affects a nonsensical combination of flags, so there shouldn't be a real impact on the userbase.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-48888

CVE-2025-48888:

5.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
deno	rust	>= 1.41.3, < 2.1.13	2.1.13
deno	rust	>= 2.2.0, < 2.2.13	2.2.13
deno	rust	>= 2.3.0, < 2.3.2	2.3.2
deno_runtime	rust	>= 0.150.0, < 0.212.0	0.212.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in how Deno handles contradictory permission flags, specifically when a global allow flag (e.g., --allow-read) and a global deny flag (e.g., --deny-read) are used simultaneously. The deny directive should take precedence, but due to an issue in the is_allow_all function within runtime/permissions/lib.rs, this was not the case. The function failed to check if a global deny flag was set, leading to the permission being incorrectly granted. The provided patches (2f0fae9d, 9d665572, ef315b56) all address this by adding checks for self.flag_denied_global and self.prompt_denied_global within the is_allow_all method of the UnaryPermission struct. Therefore, deno_runtime::permissions::UnaryPermission::is_allow_all is the specific function that, in its unpatched state, would lead to this incorrect authorization. During exploitation (i.e., running Deno with contradictory flags), this function would be called to determine if a global permission is granted, and it would erroneously return true.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

5.5

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-48888: Deno run with --allow-read and --deny-read flags results in allowed

Summary

Details

PoC

Impact

CVE-2025-48888:

5.5

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

CVE-2025-48888: Deno run with --allow-read and --deny-read flags results in allowed

Summary

Details

PoC

Impact

5.5

5.5

Basic Information

Basic Information

Technical Details

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI