CVE-2025-46818
BaseFortify
Publication date: 2025-10-03
Last updated on: 2025-11-12
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| redis | redis | From 7.0.0 (inc) to 7.2.9 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Redis versions 8.2.1 and below allows an authenticated user to use a specially crafted Lua script to manipulate different Lua objects and potentially execute their own code in the context of another user. It affects all Redis versions with Lua scripting enabled and is fixed in version 8.2.2. A workaround is to prevent users from executing Lua scripts by restricting the EVAL and FUNCTION command families using ACL.
How can this vulnerability impact me? :
The vulnerability can allow an authenticated user to run arbitrary code as another user, potentially leading to unauthorized access or actions within the Redis environment. This could compromise the confidentiality and integrity of data stored in Redis.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability immediately without patching, you should prevent users from executing LUA scripts by using Access Control Lists (ACL) to block the EVAL and FUNCTION command families. Alternatively, upgrade Redis to version 8.2.2 or later where the issue is fixed.