{"id":"CVE-2026-63225","title":"Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier","summary":"Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to @redocly/cli 2.33.2, the split command constructs output paths under --outDir from untrusted OpenAPI or AsyncAPI component names and x-codeSample…","severity":"medium","cvss":4.4,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","cwe":["CWE-22","CWE-73"],"vendor":"Redocly","product":"redocly-cli","affected":["redocly-cli < 1.34.17","redocly-cli >= 2.0.0, < 2.33.2"],"patched":["@redocly/cli 1.34.17","@redocly/cli 2.33.2"],"published":"2026-09-16","updated":"2026-09-17","sourceUpdated":"2026-09-17T17:16:45.010","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63225","references":[{"url":"https://github.com/Redocly/redocly-cli/commit/26a0f299fae0b3bb7bd513043d2f1e90e69f79ee","label":"security-advisories@github.com"},{"url":"https://github.com/Redocly/redocly-cli/commit/504120419a72b5c684471478337ee3b45d8bfad3","label":"security-advisories@github.com"},{"url":"https://github.com/Redocly/redocly-cli/pull/2891","label":"security-advisories@github.com"},{"url":"https://github.com/Redocly/redocly-cli/pull/2923","label":"security-advisories@github.com"},{"url":"https://github.com/Redocly/redocly-cli/releases/tag/@redocly/cli@1.34.17","label":"security-advisories@github.com"},{"url":"https://github.com/Redocly/redocly-cli/releases/tag/@redocly/cli@2.33.2","label":"security-advisories@github.com"},{"url":"https://github.com/Redocly/redocly-cli/security/advisories/GHSA-657c-g7qc-r9j2","label":"security-advisories@github.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63225"},{"url":"https://github.com/advisories/GHSA-657c-g7qc-r9j2"}],"tags":["nvd","cve.org","ghsa","npm"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-17T16:13:39.074016Z"},"aliases":["GHSA-657c-g7qc-r9j2"],"ecosystem":"npm","ingestedAt":"2026-09-16T20:03:30.755Z","epss":0.00179,"epssPercentile":0.06607,"slug":"CVE-2026-63225","body":"## Overview\n\nRedocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to @redocly/cli 2.33.2, the split command constructs output paths under --outDir from untrusted OpenAPI or AsyncAPI component names and x-codeSamples lang values without verifying that the resolved target remains inside the selected directory. A description containing literal ../ traversal segments in those fields can cause the split command to place or overwrite files outside --outDir. Component data remains constrained to YAML or JSON, and code-sample filenames remain based on the HTTP method, so this is not an unrestricted arbitrary-content file write. This issue is fixed in @redocly/cli version 2.33.2.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-63225)\n\nAffected packages:\n\n- `@redocly/cli < 1.34.17`\n- `@redocly/cli >= 2.0.0, < 2.33.2`\n\nPatched in:\n\n- `@redocly/cli 1.34.17`\n- `@redocly/cli 2.33.2`\n\nSource: https://github.com/advisories/GHSA-657c-g7qc-r9j2","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":24.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}