| Название | redocly redocly-cli 2.32.2 Code Injection |
|---|
| Описание | Arbitrary code execution via Arazzo $faker runtime expressions in the respect command. @redocly/respect-core builds a JavaScript function with new Function from specification content, so a malicious Arazzo description executes arbitrary code in the process running respect. Because respect is documented for automated contract testing over supplied files, an attacker who only submits a file (for example via a pull request) achieves unattended code execution with the runner's privileges
POC: https://gist.github.com/thegr1ffyn/2e1afa23f4ea3a61b651139305339e2a |
|---|
| Источник | ⚠️ https://github.com/Redocly/redocly-cli/pull/2891 |
|---|
| Пользователь | thegr1ffyn (UID 98937) |
|---|
| Представление | 22.06.2026 21:53 (2 месяцы назад) |
|---|
| Модерация | 08.08.2026 16:06 (2 months later) |
|---|
| Статус | Дубликат |
|---|
| Запись VulDB | 387186 [redocly redocly-cli до 2.32.2 Split Command iterate-components.ts обход каталога] |
|---|
| Баллы | 0 |
|---|