CVE-2025-46818

Katalog CVE

CVSS 7.3 · High EPSS 0,73%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada redis. Skor CVSS 3.1 7.3 (High) menurut NVD.

Deskripsi (NVD)

Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user. The problem exists in all versions of Redis with LUA scripting. This issue is fixed in version 8.2.2. A workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing LUA scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families.

Rincian

Terbit di NVD

3 Oktober 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.3 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

0,73% peluang dieksploitasi; lebih tinggi dari 52,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/redis/redis/commit/45eac0262028c771b6f5307372814b75f49f7a9e patch
• https://github.com/redis/redis/security/advisories/GHSA-qrv7-wcrx-q5jp advisory pihak ketiga
• https://github.com/redis/redis/releases/tag/8.2.2 release notes