GHSA-657C-G7QC-R9J2 Redocly CLI: Path traversal when using `split` command

Impact An OpenAPI or AsyncAPI description could make the split command write files outside the chosen output directory, on the machine of anyone who runs split against it. The write is constrained rather than a free file-write primitive: component data is emitted only as YAML/JSON, and code-sampl...

EUVD-2026-81013

Redocly CLI: Path traversal when using split command...

Redocly CLI: Path traversal when using `split` command

Impact An OpenAPI or AsyncAPI description could make the split command write files outside the chosen output directory, on the machine of anyone who runs split against it. The write is constrained rather than a free file-write primitive: component data is emitted only as YAML/JSON, and code-sampl...

@acmekit/acmekit-oas-cli (>=2.13.1, <=2.13.94), @apifactory/openapi-builder (>=1.0.0, <=1.0.5) +8 more potentially affected by CVE-2026-63225 via @redocly/cli (>=1.0.0-beta.123, <=1.34.5)

@redocly/cli NPM version =1.0.0-beta.123, =2.13.1, =1.0.0, =0.2.2-next-20230413194207, =1.0.0, =1.3.33, =8.0.1-fix-binary-778dccce.0, =1.2.13, =2.15.5, =2.16.3 Source cves: CVE-2026-63225 Source advisory: OSV:GHSA-657C-G7QC-R9J2...

@acmekit/acmekit-oas-cli (>=2.13.1, <=2.13.94), @apifactory/openapi-builder (>=1.0.0, <=1.0.5) +8 more potentially affected by CVE-2026-63225 via @redocly/cli (>=1.0.0-beta.123, <=1.34.5)

@redocly/cli NPM version =1.0.0-beta.123, =2.13.1, =1.0.0, =0.2.2-next-20230413194207, =1.0.0, =1.3.33, =8.0.1-fix-binary-778dccce.0, =1.2.13, =2.15.5, =2.16.3 Source cves: CVE-2026-63225 Source advisory: GHSA-657C-G7QC-R9J2...

@bymbly/api-tools (>=1.3.1, <=1.4.55), @fsco/autosync (>=0.2.12, <=0.3.1) +1 more potentially affected by CVE-2026-63225 via @redocly/cli (>=2.0.2, <=2.32.2)

@redocly/cli NPM version =2.0.2, =1.3.1, =0.2.12, =2.5.0, =3.11.1 Source cves: CVE-2026-63225 Source advisory: OSV:GHSA-657C-G7QC-R9J2...

@bymbly/api-tools (>=1.3.1, <=1.4.55), @fsco/autosync (>=0.2.12, <=0.3.1) +1 more potentially affected by CVE-2026-63225 via @redocly/cli (>=2.0.2, <=2.32.2)

@redocly/cli NPM version =2.0.2, =1.3.1, =0.2.12, =2.5.0, =3.11.1 Source cves: CVE-2026-63225 Source advisory: GHSA-657C-G7QC-R9J2...

CVE-2026-63325

Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to version 2.33.0 of @redocly/respect-core and @redocly/cli, the respect command dynamically evaluates $faker runtime expressions in Arazzo descriptions. A crafted expression can traverse constructor,...

CVE-2026-63225

Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to @redocly/cli 2.33.2, the split command constructs output paths under --outDir from untrusted OpenAPI or AsyncAPI component names and x-codeSamples lang values without verifying that the resolved target...

CVE-2026-63225

Redocly CLI prior to @redocly/cli 2.33.2 is vulnerable to a path traversal in the split command. The command constructs output file paths under --outDir from untrusted OpenAPI or AsyncAPI component names and x-codeSamples lang values without verifying the resolved target remains inside the select...

CVE-2026-63225 Redocly CLI: Path traversal when using `split` command

Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to @redocly/cli 2.33.2, the split command constructs output paths under --outDir from untrusted OpenAPI or AsyncAPI component names and x-codeSamples lang values without verifying that the resolved target...

CVE-2026-63225

Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to @redocly/cli 2.33.2, the split command constructs output paths under --outDir from untrusted OpenAPI or AsyncAPI component names and x-codeSamples lang values without verifying that the resolved target...

@acmekit/acmekit-oas-cli (>=2.13.1, <=2.13.94), @apifactory/openapi-builder (>=1.0.0, <=1.0.5) +8 more potentially affected by CVE-2026-63225 via @redocly/cli (>=1.0.0-beta.123, <=1.34.5)

@redocly/cli NPM version =1.0.0-beta.123, =2.13.1, =1.0.0, =0.2.2-next-20230413194207, =1.0.0, =1.3.33, =8.0.1-fix-binary-778dccce.0, =1.2.13, =2.15.5, =2.16.3 Source cves: CVE-2026-63225 Source advisory: MEND:CVE-2026-63225...

@bymbly/api-tools (>=1.3.1, <=1.4.55), @fsco/autosync (>=0.2.12, <=0.3.1) +1 more potentially affected by CVE-2026-63225 via @redocly/cli (>=2.0.2, <=2.32.2)

@redocly/cli NPM version =2.0.2, =1.3.1, =0.2.12, =2.5.0, =3.11.1 Source cves: CVE-2026-63225 Source advisory: MEND:CVE-2026-63225...

CVE-2026-63225 Redocly CLI: Path traversal when using `split` command

Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to @redocly/cli 2.33.2, the split command constructs output paths under --outDir from untrusted OpenAPI or AsyncAPI component names and x-codeSamples lang values without verifying that the resolved target...

CVE-2026-63225 Redocly CLI: Path traversal when using `split` command

Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to @redocly/cli 2.33.2, the split command constructs output paths under --outDir from untrusted OpenAPI or AsyncAPI component names and x-codeSamples lang values without verifying that the resolved target...

CVE-2026-63325 Redocly CLI: Arbitrary code execution via Arazzo `$faker` expression using `respect`

Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to version 2.33.0 of @redocly/respect-core and @redocly/cli, the respect command dynamically evaluates $faker runtime expressions in Arazzo descriptions. A crafted expression can traverse constructor,...

CVE-2026-63325 Redocly CLI: Arbitrary code execution via Arazzo `$faker` expression using `respect`

Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to version 2.33.0 of @redocly/respect-core and @redocly/cli, the respect command dynamically evaluates $faker runtime expressions in Arazzo descriptions. A crafted expression can traverse constructor,...

@redocly/cli (>=1.31.1, <=1.34.16), @team-supercharge/oasg (>=17.0.1, <=20.0.0) potentially affected by CVE-2026-63325 via @redocly/respect-core (>=1.31.1, <=1.34.16)

@redocly/respect-core NPM version =1.31.1, =1.31.1, =17.0.1, =20.0.0 Source cves: CVE-2026-63325 Source advisory: MEND:CVE-2026-63325...

CVE-2026-63325 Redocly CLI: Arbitrary code execution via Arazzo `$faker` expression using `respect`

Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to version 2.33.0 of @redocly/respect-core and @redocly/cli, the respect command dynamically evaluates $faker runtime expressions in Arazzo descriptions. A crafted expression can traverse constructor,...