CVE-2025-61785

Deno is a JavaScript, TypeScript, and WebAssembly runtime. In versions prior to 2.5.3 and 2.2.15, `Deno.FsFile.prototype.utime` and `Deno.FsFile.prototype.utimeSync` are not limited by the permission model check `--deny-write=./`. It's possible to change to change the access (`atime`) and modification (`mtime`) times on the file stream resource even when the file is opened with `read` only permission (and `write`: `false`) and file write operations are not allowed (the script is executed with `--deny-write=./`). Similar APIs like `Deno.utime` and `Deno.utimeSync` require `allow-write` permission, however, when a file is opened, even with read only flags and deny-write permission, it's still possible to change the access (`atime`) and modification (`mtime`) times, and thus bypass the permission model. Versions 2.5.3 and 2.2.15 fix the issue.

• CWE-266

• https://github.com/denoland/deno/commit/992e998dfe436cdc9325232759af8be92f11739bPatch
• https://github.com/denoland/deno/pull/30872Issue Tracking, Patch
• https://github.com/denoland/deno/releases/tag/v2.2.15Release Notes
• https://github.com/denoland/deno/releases/tag/v2.5.3Release Notes
• https://github.com/denoland/deno/security/advisories/GHSA-vg2r-rmgp-cgqjExploit, Vendor Advisory

Published

Oct 8, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-61779Confidential Containers's Trustee project contains tools and…8.7
• CVE-2025-61780Rack is a modular Ruby web server interface. Prior to versio…5.3
• CVE-2025-61781OpenCTI is an open source platform for managing cyber threat…9.1
• CVE-2025-61782OpenCTI is an open source platform for managing cyber threat…6.1
• CVE-2025-61783Python Social Auth is a social authentication/registration m…6.3
• CVE-2025-61784LLaMA-Factory is a tuning library for large language models.…8.1
• CVE-2025-61786Deno is a JavaScript, TypeScript, and WebAssembly runtime. I…3.3
• CVE-2025-61787Deno is a JavaScript, TypeScript, and WebAssembly runtime. V…8.1
• CVE-2025-61788Opencast is a free, open-source platform to support the mana…5.4
• CVE-2025-61789Icinga DB Web provides a graphical interface for Icinga moni…6.5
• CVE-2025-6179Permissions Bypass in Extension Management in Google ChromeO…9.8
• CVE-2025-61792Quadient DS-700 iQ devices through 2025-09-30 might have a r…6.4