1vulnerability
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate1 (100.0%)
- Low0 (0.0%)
redocly-cli
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 1ModerateAffects 2 versions
- 0LowAffects 0 versions
Monthly breakdown
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting redocly-cli, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-657c-g7qc-r9j2 | Moderate | Redocly CLI: Path traversal when using `split` command### Impact An OpenAPI or AsyncAPI description could make the `split` command write files outside the chosen output directory, on the machine of anyone who runs `split` against it. The write is constrained rather than a free file-write primitive: component data is emitted only as YAML/JSON, and code-sample files are named after the HTTP method, so an attacker can place or overwrite files at an unintended path but has limited control over their name and contents. ### Patches Fixed in `@redocly/cli` v2.33.2. ### Workarounds Do not run the `split` command on API descriptions from untrusted or |
| GitHub (opens in a new tab) |
- GHSA-657c-g7qc-r9j2ModerateRedocly CLI: Path traversal when using `split` command
< 1.34.17>= 2.0.0, < 2.33.2
### Impact An OpenAPI or AsyncAPI description could make the `split` command write files outside the chosen output directory, on the machine of anyone who runs `split` against it. The write is constrained rather than a free file-write primitive: component data is emitted only as YAML/JSON, and code-sample files are named after the HTTP method, so an attacker can place or overwrite files at an unintended path but has limited control over their name and contents. ### Patches Fixed in `@redocly/cli` v2.33.2. ### Workarounds Do not run the `split` command on API descriptions from untrusted or
CVE: CVE-2026-63225