N/A

CVSS Score

Basic Information

CVE ID

CVE-2025-48934

GHSA ID

GHSA-7w8p-chxq-2789

EPSS Score

0.12686%

CWE

CWE-201

Published

6/4/2025

Updated

6/4/2025

KEV Status

Technology

Rust

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-48934

CVE-2025-48934: Deno.env.toObject() ignores the variables listed in --deny-env and returns all environment variables

Summary

The Deno.env.toObject method ignores any variables listed in the --deny-env option of the deno run command. When looking at the documentation of the --deny-env option this might lead to a false impression that variables listed in the option are impossible to read.

PoC

export AWS_SECRET_ACCESS_KEY=my-secret-aws-key

# Works as expected. The program stops with a "NotCapable" error message
echo 'console.log(Deno.env.get("AWS_SECRET_ACCESS_KEY"));' | deno run \
  --allow-env \
  --deny-env=AWS_ACCESS_KEY_ID,AWS_SECRET_ACCESS_KEY -

# All enviroment variables are printed and the --deny-env list is completely disregarded
echo 'console.log(Deno.env.toObject());' | deno run \
  --allow-env \
  --deny-env=AWS_ACCESS_KEY_ID,AWS_SECRET_ACCESS_KEY -

The first example using get exits with the following error:

error: Uncaught (in promise) NotCapable: Requires env access to "AWS_SECRET_ACCESS_KEY", run again with the --allow-env flag
console.log(Deno.env.get("AWS_SECRET_ACCESS_KEY"));
                     ^
    at Object.getEnv [as get] (ext:deno_os/30_os.js:124:10)
    at file:///$deno$stdin.mts:1:22

The second example using toObject prints all environment variables:

[Object: null prototype] {
  ...
  AWS_SECRET_ACCESS_KEY: "my-secret-aws-key",
  ...
}

Impact

Software relying on the combination of both flags to allow access to most environment variables except a few sensitive ones will be vulnerable to malicious code trying to steal secrets using the Deno.env.toObject() method.

(GitHub Advisory)

N/A

CVSS Score

Basic Information

CVE ID

CVE-2025-48934

GHSA ID

GHSA-7w8p-chxq-2789

EPSS Score

0.12686%

CWE

CWE-201

Published

6/4/2025

Updated

6/4/2025

KEV Status

Technology

Rust

Technical Details

CVSS Vector

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
deno	rust	< 2.1.13	2.1.13
deno	rust	>= 2.2.0, < 2.2.13	2.2.13
deno_runtime	rust	< 0.212.0	0.212.0

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows Deno.env.toObject() to bypass the --deny-env security control, exposing all environment variables even if some are explicitly denied. This occurs when --allow-env is used, even if it's an empty list (which implies allowing access to all variables not explicitly denied).

The root cause lies in the Rust backend, specifically within the check_all method of the UnaryPermission<EnvQueryDescriptor> implementation in runtime/permissions/lib.rs. Before the patch, this function called an internal method check_desc with parameters that did not correctly enforce the deny list when retrieving all environment variables. The provided PoC clearly demonstrates that Deno.env.toObject() returns variables that should have been denied.

The patch (e.g., commit 2959e083912420988066a001c2b2d6732a1b562f) modifies the check_all function by changing the way check_desc is called (from self.check_desc(None, false, None) to self.check_desc(None, true, None)). This change ensures that the deny list is respected during the permission check for Deno.env.toObject().

Therefore, two key functions are identified:

Deno.env.toObject(): The user-facing JavaScript API that exhibits the vulnerable behavior. This is what an attacker would call and what would appear in a JavaScript profiler/stack trace.
deno_runtime::permissions::UnaryPermission<EnvQueryDescriptor>::check_all: The underlying Rust function in the Deno runtime that contained the flawed permission logic. This is where the code fix was applied.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Summ*ry T** [**no.*nv.toO*j**t](*ttps://*o*s.**no.*om/*pi/**no/~/**no.*nv.toO*j**t) m*t*o* i*nor*s *ny v*ri**l*s list** in t** `--**ny-*nv` option o* t** `**no run` *omm*n*. W**n lookin* *t t** [*o*um*nt*tion](*ttps://*o*s.**no.*om/runtim*/*un**m

Reasoning

T** vuln*r**ility *llows `**no.*nv.toO*j**t()` to *yp*ss t** `--**ny-*nv` s**urity *ontrol, *xposin* *ll *nvironm*nt v*ri**l*s *v*n i* som* *r* *xpli*itly **ni**. T*is o**urs w**n `--*llow-*nv` is us**, *v*n i* it's *n *mpty list (w*i** impli*s *llow

N/A

Basic Information

Concerned about an active attack path?

CVE-2025-48934: Deno.env.toObject() ignores the variables listed in --deny-env and returns all environment variables

Summary

PoC

Impact

N/A

Basic Information

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability Intelligence
Miggo AI