CVE-2026-63325 Details
Description
Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to version 2.33.0 of @redocly/respect-core and @redocly/cli, the respect command dynamically evaluates $faker runtime expressions in Arazzo descriptions. A crafted expression can traverse constructor, prototype, or __proto__ properties in packages/respect-core/src/modules/context-parser/get-value-from-context.ts, reach the JavaScript Function constructor, and execute arbitrary code when a user processes an untrusted description. The executed code runs with the privileges of the CLI process and can execute shell commands or read CI secrets. Users processing only trusted, self-authored workflows are not affected. This issue is fixed in @redocly/respect-core and @redocly/cli version 2.33.0.
A remote code execution vulnerability exists in Redocly CLI versions prior to 2.33.0, specifically within the Respect command. The issue arises from the dynamic evaluation of $faker runtime expressions in Arazzo descriptions. A crafted expression can exploit this behavior by traversing prototype properties, reaching the JavaScript Function constructor, and executing arbitrary code. This executed code runs with the privileges of the CLI process, potentially allowing the execution of shell commands or access to CI secrets. The vulnerability affects users processing untrusted descriptions, such as third-party or pull-request content, while those using their own workflows are not impacted.
Users can update to Redocly CLI version 2.33.0 or later, where this vulnerability has been fixed. For those using the Respect Core package, ensure to update to version 2.33.0 or later as well.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 16, 2026CISA-ADP
Assessed Sep 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Redocly/redocly-cli/commit/d26d452368066be1400f43cea915dd9ea508e18b | [email protected] | Source CodeVendor |
| https://github.com/Redocly/redocly-cli/pull/2881 | [email protected] | Issue TrackingVendor |
| https://github.com/Redocly/redocly-cli/pull/2922 | [email protected] | Issue TrackingVendor |
| https://github.com/Redocly/redocly-cli/releases/tag/@redocly/[email protected] | [email protected] | Release NotesVendor |
| https://github.com/Redocly/redocly-cli/releases/tag/@redocly/[email protected] | [email protected] | Release NotesVendor |
| https://github.com/Redocly/redocly-cli/security/advisories/GHSA-xw2f-5386-m542 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
| CWE-95 | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Redocly CLI | < 2.33.0 (semver) |
CPE
Remediation
| |
| Redocly Respect Core | < 2.33.0 (semver) < 1.34.17 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 18, 2026 | CVE Modified | CISA-ADP |
| Sep 16, 2026 | New CVE Received | [email protected] |