CVE-2025-48934
Deno.env.toObject() ignores the variables listed in --deny-env and returns all environment variables
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Deno.env.toObject() ignores the variables listed in --deny-env and returns all environment variables
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to versions 2.1.13 and 2.2.13, the `Deno.env.toObject` method ignores any variables listed in the `--deny-env` option of the `deno run` command. When looking at the documentation of the `--deny-env` option this might lead to a false impression that variables listed in the option are impossible to read. Software relying on the combination of both flags to allow access to most environment variables except a few sensitive ones will be vulnerable to malicious code trying to steal secrets using the `Deno.env.toObject()` method. Versions 2.1.13 and 2.2.13 contains a patch.
Reserved 2025-05-28 | Published 2025-06-04 | Updated 2025-06-04 | Assigner GitHub_MCWE-201: Insertion of Sensitive Information Into Sent Data
github.com/...d/deno/security/advisories/GHSA-7w8p-chxq-2789
github.com/denoland/deno/pull/29079
github.com/...ommit/2959e083912420988066a001c2b2d6732a1b562f
github.com/...ommit/946ccda1aa19a00c478a5e6826b75053b050d753
docs.deno.com/api/deno/~/Deno.Env.toObject
docs.deno.com/runtime/fundamentals/security/
Support options
