Vulnerability-Lookup

GHSA-657C-G7QC-R9J2

Vulnerability from github – Published: 2026-09-17 14:58 – Updated: 2026-09-17 14:58

Summary

Redocly CLI: Path traversal when using `split` command

Details

Impact

An OpenAPI or AsyncAPI description could make the split command write files outside the chosen output directory, on the machine of anyone who runs split against it. The write is constrained rather than a free file-write primitive: component data is emitted only as YAML/JSON, and code-sample files are named after the HTTP method, so an attacker can place or overwrite files at an unintended path but has limited control over their name and contents.

Patches

Fixed in @redocly/cli v2.33.2.

Workarounds

Do not run the split command on API descriptions from untrusted or unreviewed sources.

To detect an exploit attempt, inspect the description's component names and x-codeSamples lang values for a literal ../ — neither legitimately contains path segments.

Severity

4.4 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@redocly/cli"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.34.17"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@redocly/cli"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.33.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-63225"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-73"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-17T14:58:50Z",
    "nvd_published_at": "2026-09-16T19:17:24Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nAn OpenAPI or AsyncAPI description could make the `split` command write\nfiles outside the chosen output directory, on the machine of anyone who runs\n`split` against it. The write is constrained rather than a free file-write\nprimitive: component data is emitted only as YAML/JSON, and code-sample files are\nnamed after the HTTP method, so an attacker can place or overwrite files at an\nunintended path but has limited control over their name and contents.\n\n### Patches\n\nFixed in `@redocly/cli` v2.33.2.\n\n### Workarounds\n\nDo not run the `split` command on API descriptions from untrusted or unreviewed sources.\n\nTo detect an exploit attempt, inspect the description\u0027s component names and\n`x-codeSamples` `lang` values for a literal `../` \u2014 neither legitimately contains\npath segments.",
  "id": "GHSA-657c-g7qc-r9j2",
  "modified": "2026-09-17T14:58:50Z",
  "published": "2026-09-17T14:58:50Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Redocly/redocly-cli/security/advisories/GHSA-657c-g7qc-r9j2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63225"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Redocly/redocly-cli/pull/2891"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Redocly/redocly-cli/pull/2923"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Redocly/redocly-cli/commit/26a0f299fae0b3bb7bd513043d2f1e90e69f79ee"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Redocly/redocly-cli/commit/504120419a72b5c684471478337ee3b45d8bfad3"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Redocly/redocly-cli"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Redocly/redocly-cli/releases/tag/@redocly/cli@1.34.17"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Redocly/redocly-cli/releases/tag/@redocly/cli@2.33.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Redocly CLI: Path traversal when using `split` command"
}

CVE-2026-63225 (GCVE-0-2026-63225)

Vulnerability from cvelistv5 – Published: 2026-09-16 19:09 – Updated: 2026-09-17 16:13

Title

Redocly CLI: Path traversal when using `split` command

Summary

Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to @redocly/cli 2.33.2, the split command constructs output paths under --outDir from untrusted OpenAPI or AsyncAPI component names and x-codeSamples lang values without verifying that the resolved target remains inside the selected directory. A description containing literal ../ traversal segments in those fields can cause the split command to place or overwrite files outside --outDir. Component data remains constrained to YAML or JSON, and code-sample filenames remain based on the HTTP method, so this is not an unrestricted arbitrary-content file write. This issue is fixed in @redocly/cli version 2.33.2.

Severity

4.4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-17 16:13 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-73 - External Control of File Name or Path

Assigner

GitHub_M mitre root

References

7 references

URL	Tags
https://github.com/Redocly/redocly-cli/security/a…	x_refsource_CONFIRM
https://github.com/Redocly/redocly-cli/pull/2891	x_refsource_MISC
https://github.com/Redocly/redocly-cli/pull/2923	x_refsource_MISC
https://github.com/Redocly/redocly-cli/commit/26a…	x_refsource_MISC
https://github.com/Redocly/redocly-cli/commit/504…	x_refsource_MISC
https://github.com/Redocly/redocly-cli/releases/t…	x_refsource_MISC
https://github.com/Redocly/redocly-cli/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Redocly	redocly-cli	Affected: < 1.34.17 Affected: >= 2.0.0, < 2.33.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63225",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-17T16:13:39.074016Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-17T16:13:49.405Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "redocly-cli",
          "vendor": "Redocly",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.34.17"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.33.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to @redocly/cli 2.33.2, the split command constructs output paths under --outDir from untrusted OpenAPI or AsyncAPI component names and x-codeSamples lang values without verifying that the resolved target remains inside the selected directory. A description containing literal ../ traversal segments in those fields can cause the split command to place or overwrite files outside --outDir. Component data remains constrained to YAML or JSON, and code-sample filenames remain based on the HTTP method, so this is not an unrestricted arbitrary-content file write. This issue is fixed in @redocly/cli version 2.33.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "CWE-73: External Control of File Name or Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T19:09:00.593Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Redocly/redocly-cli/security/advisories/GHSA-657c-g7qc-r9j2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Redocly/redocly-cli/security/advisories/GHSA-657c-g7qc-r9j2"
        },
        {
          "name": "https://github.com/Redocly/redocly-cli/pull/2891",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Redocly/redocly-cli/pull/2891"
        },
        {
          "name": "https://github.com/Redocly/redocly-cli/pull/2923",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Redocly/redocly-cli/pull/2923"
        },
        {
          "name": "https://github.com/Redocly/redocly-cli/commit/26a0f299fae0b3bb7bd513043d2f1e90e69f79ee",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Redocly/redocly-cli/commit/26a0f299fae0b3bb7bd513043d2f1e90e69f79ee"
        },
        {
          "name": "https://github.com/Redocly/redocly-cli/commit/504120419a72b5c684471478337ee3b45d8bfad3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Redocly/redocly-cli/commit/504120419a72b5c684471478337ee3b45d8bfad3"
        },
        {
          "name": "https://github.com/Redocly/redocly-cli/releases/tag/@redocly/cli@1.34.17",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Redocly/redocly-cli/releases/tag/@redocly/cli@1.34.17"
        },
        {
          "name": "https://github.com/Redocly/redocly-cli/releases/tag/@redocly/cli@2.33.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Redocly/redocly-cli/releases/tag/@redocly/cli@2.33.2"
        }
      ],
      "source": {
        "advisory": "GHSA-657c-g7qc-r9j2",
        "discovery": "UNKNOWN"
      },
      "title": "Redocly CLI: Path traversal when using `split` command"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63225",
    "datePublished": "2026-09-16T19:09:00.593Z",
    "dateReserved": "2026-07-15T22:19:06.907Z",
    "dateUpdated": "2026-09-17T16:13:49.405Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.