High-Severity Deno Flaw CVE-2025-61787 Allows Command Injection on Windows

The Deno project has issued a security advisory warning of a high-severity command-injection vulnerability on Windows, tracked as CVE-2025-61787 and rated CVSS 8.1; the flaw affects Deno versions up to 2.5.1 and could allow attackers to execute arbitrary commands when batch files are spawned under certain conditions.

According to the advisory, “Deno versions up to 2.5.1 are vulnerable to Command Line Injection attacks on Windows when batch files are executed.” The issue is rooted in a Windows process-creation quirk where CreateProcess() implicitly spawns cmd.exe for batch files, which can route execution through the command interpreter and enable injection if user-supplied arguments are passed.

The Deno security team provided two PoC examples showing how the vulnerability can be exploited, using Node.js’s child_process module and Deno.Command[.]spawn(). Patched versions are available: 2.2.15 (backported fix) and 2.5.2 (latest stable release), with developers urged to update immediately. 9 October 2025.