CVE-2026-63225

MediumCVSS 4.4

Published: 16/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 17/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

Prior to @redocly/cli 2.33.2, the split command constructs output paths under --outDir from untrusted OpenAPI or AsyncAPI component names and x-codeSamples lang values without verifying that the resolved target remains inside the selected directory. A description containing literal ../ traversal segments in those fields can cause the split command to place or overwrite files outside --outDir.

Risk Assessment

An attacker could overwrite files outside the intended output directory, potentially leading to data corruption or code execution if overwritten files are used by other processes. The risk is limited because component data remains constrained to YAML or JSON, and code-sample filenames remain based on the HTTP method.

Recommendation

Update @redocly/cli to version 2.33.2 or later, which fixes this issue. Avoid running the split command on untrusted OpenAPI/AsyncAPI specifications without prior validation.

Other vulnerabilities in @redocly/cli

CVE-2026-63325High
Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to version 2.33.0 of @redocly/respect-core and @redocly/cli, the respect command dynamically evaluates $faker runtime expressions in Arazzo descriptions. A crafted expression can traverse constructor, prototype, or __proto__ properties in packages/respect-core/src/modules/context-parser/get-value-from-context.ts, reach the JavaScript Function constructor, and execute arbitrary code when a user processes an untrusted description. The executed code runs with the privileges of the CLI process and can execute shell commands or read CI secrets. Users processing only trusted, self-authored workflows are not affected. This issue is fixed in @redocly/respect-core and @redocly/cli version 2.33.0.

Original NVD description (English source)

Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to @redocly/cli 2.33.2, the split command constructs output paths under --outDir from untrusted OpenAPI or AsyncAPI component names and x-codeSamples lang values without verifying that the resolved target remains inside the selected directory. A description containing literal ../ traversal segments in those fields can cause the split command to place or overwrite files outside --outDir. Component data remains constrained to YAML or JSON, and code-sample filenames remain based on the HTTP method, so this is not an unrestricted arbitrary-content file write. This issue is fixed in @redocly/cli version 2.33.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS