{"id":"GHSA-657c-g7qc-r9j2","summary":"Redocly CLI: Path traversal when using `split` command","details":"### Impact\n\nAn OpenAPI or AsyncAPI description could make the `split` command write\nfiles outside the chosen output directory, on the machine of anyone who runs\n`split` against it. The write is constrained rather than a free file-write\nprimitive: component data is emitted only as YAML/JSON, and code-sample files are\nnamed after the HTTP method, so an attacker can place or overwrite files at an\nunintended path but has limited control over their name and contents.\n\n### Patches\n\nFixed in `@redocly/cli` v2.33.2.\n\n### Workarounds\n\nDo not run the `split` command on API descriptions from untrusted or unreviewed sources.\n\nTo detect an exploit attempt, inspect the description's component names and\n`x-codeSamples` `lang` values for a literal `../` — neither legitimately contains\npath segments.","aliases":["CVE-2026-63225"],"modified":"2026-09-17T16:32:22.063735184Z","published":"2026-09-17T14:58:50Z","database_specific":{"github_reviewed_at":"2026-09-17T14:58:50Z","nvd_published_at":"2026-09-16T19:17:24Z","cwe_ids":["CWE-22","CWE-73"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/Redocly/redocly-cli/security/advisories/GHSA-657c-g7qc-r9j2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63225"},{"type":"WEB","url":"https://github.com/Redocly/redocly-cli/pull/2891"},{"type":"WEB","url":"https://github.com/Redocly/redocly-cli/pull/2923"},{"type":"WEB","url":"https://github.com/Redocly/redocly-cli/commit/26a0f299fae0b3bb7bd513043d2f1e90e69f79ee"},{"type":"WEB","url":"https://github.com/Redocly/redocly-cli/commit/504120419a72b5c684471478337ee3b45d8bfad3"},{"type":"PACKAGE","url":"https://github.com/Redocly/redocly-cli"},{"type":"WEB","url":"https://github.com/Redocly/redocly-cli/releases/tag/@redocly/cli@1.34.17"},{"type":"WEB","url":"https://github.com/Redocly/redocly-cli/releases/tag/@redocly/cli@2.33.2"}],"affected":[{"package":{"name":"@redocly/cli","ecosystem":"npm","purl":"pkg:npm/%40redocly/cli"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.34.17"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-657c-g7qc-r9j2/GHSA-657c-g7qc-r9j2.json"}},{"package":{"name":"@redocly/cli","ecosystem":"npm","purl":"pkg:npm/%40redocly/cli"},"ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.33.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-657c-g7qc-r9j2/GHSA-657c-g7qc-r9j2.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"}]}