// For flags

CVE-2025-48934

Deno.env.toObject() ignores the variables listed in --deny-env and returns all environment variables

Severity Score

5.5
*CVSS v4

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Attend
*SSVC
Descriptions

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to versions 2.1.13 and 2.2.13, the `Deno.env.toObject` method ignores any variables listed in the `--deny-env` option of the `deno run` command. When looking at the documentation of the `--deny-env` option this might lead to a false impression that variables listed in the option are impossible to read. Software relying on the combination of both flags to allow access to most environment variables except a few sensitive ones will be vulnerable to malicious code trying to steal secrets using the `Deno.env.toObject()` method. Versions 2.1.13 and 2.2.13 contains a patch.

Deno es un entorno de ejecución de JavaScript, TypeScript y WebAssembly. En versiones anteriores a la 2.1.13 y la 2.2.13, el método `Deno.env.toObject` ignora las variables listadas en la opción `--deny-env` del comando `deno run`. Al consultar la documentación de la opción `--deny-env`, esto podría dar la falsa impresión de que las variables listadas en ella son imposibles de leer. El software que utiliza la combinación de ambos indicadores para acceder a la mayoría de las variables de entorno, excepto algunas sensibles, será vulnerable a código malicioso que intente robar secretos mediante el método `Deno.env.toObject()`. Las versiones 2.1.13 y 2.2.13 contienen un parche.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
None
System
Vulnerable | Subsequent
Confidentiality
Low
None
Integrity
Low
None
Availability
None
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Attend
Exploitation
Poc
Automatable
Yes
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2025-05-28 CVE Reserved
  • 2025-06-04 CVE Published
  • 2025-06-04 CVE Updated
  • 2025-07-03 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-201: Insertion of Sensitive Information Into Sent Data
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Denoland
Search vendor "Denoland"
 Deno
Search vendor "Denoland" for product "Deno"
 < 2.1.13
Search vendor "Denoland" for product "Deno" and version " < 2.1.13"
en
Affected
Denoland
Search vendor "Denoland"
 Deno
Search vendor "Denoland" for product "Deno"
 >= 2.2.0 < 2.2.13
Search vendor "Denoland" for product "Deno" and version " >= 2.2.0 < 2.2.13"
en
Affected