Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
Deno runtime ignores 'deny-read' flag when combined with 'allow-read'
JLSEC-2026-109
Summary
A specific combination of flags in Deno's command line interface can allow more access than intended, potentially allowing a program to read files it shouldn't be able to. This issue affects users who use this unusual combination of flags, which is not a common practice. To address this, update to a patched version of Deno, such as 2.1.13, 2.2.13, or 2.3.2.
What to do
- Update deno_jll to version 2.6.3+0.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| – | deno_jll | > 2.0.0+0 , <= 2.6.3+0 | 2.6.3+0 |
Original title
Deno run with --allow-read and --deny-read flags results in allowed
Original description
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.41.3 and prior to versions 2.1.13, 2.2.13, and 2.3.2, `deno run --allow-read --deny-read main.ts` results in allowed, even though 'deny' should be stronger. The result is the same with all global unary permissions given as `--allow-* --deny-*`. This only affects a nonsensical combination of flags, so there shouldn't be a real impact on the userbase. Users may upgrade to version 2.1.13, 2.2.13, or 2.3.2 to receive a patch.
osv CVSS4.0
7.8
- https://github.com/denoland/deno/commit/2f0fae9d9071dcaf0a689bc7097584b1b9ebc8db URL
- https://github.com/denoland/deno/commit/9d665572d3cd39f997e29e6daac7c1102fc5c04f URL
- https://github.com/denoland/deno/commit/ef315b56c26c9ef5f25284a5100d2ed525a148cf URL
- https://github.com/denoland/deno/pull/22894 URL
- https://github.com/denoland/deno/pull/29213 URL
- https://github.com/denoland/deno/security/advisories/GHSA-xqxc-x6p3-w683 URL
- https://nvd.nist.gov/vuln/detail/CVE-2025-48888 URL
- https://github.com/advisories/GHSA-xqxc-x6p3-w683 URL
Published: 14 Apr 2026 · Updated: 14 Apr 2026 · First seen: 14 Apr 2026