--- id: CVE-2026-78378 title: >- Ransomlook contains a Redis glob pattern injection vulnerability caused by insufficient neutralization of user-controlled input before it is incorporated into Redis SCAN MATCH patterns. The /api/health/ endpoint attempted to reso… summary: >- Ransomlook contains a Redis glob pattern injection vulnerability caused by insufficient neutralization of user-controlled input before it is incorporated into Redis SCAN MATCH patterns. The /api/health/ endpoint attempted to reso… severity: none cwe: - CWE-200 published: '2026-08-24' updated: '2026-10-14' sourceUpdated: '2026-10-14T13:10:00.187' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-78378' references: - url: >- https://github.com/RansomLook/RansomLook/commit/1f14c01b6fdf8d534edfb2790cf76f5bac6e73f8. label: 5a6e4751-2f3f-4070-9419-94fb35b644e8 tags: - nvd epss: 0.00447 epssPercentile: 0.37111 ingestedAt: '2026-10-14T13:30:58.560Z' --- ## Overview Ransomlook contains a Redis glob pattern injection vulnerability caused by insufficient neutralization of user-controlled input before it is incorporated into Redis SCAN MATCH patterns. The /api/health/ endpoint attempted to resolve the supplied name to a known group or market, but when resolution failed it fell back to using the attacker-controlled value directly in a Redis key pattern. An unauthenticated attacker could therefore supply Redis glob metacharacters such as *, ?, [ or ] to broaden the SCAN operation beyond the intended group. For example, requesting /api/health/* could enumerate health information, mirror slugs, and uptime series belonging to all groups and markets, including entities marked as private. Similar unsafe interpolation was present in /api/crypto/chain/ and in the delete_manual_torrent() function. The latter represents a potentially destructive sink because a crafted infohash containing glob metacharacters could cause the scan to match torrent-health keys belonging to other torrents if attacker-controlled input can reach that function. The patch removes the unsafe fallback from the health endpoint and introduces glob escaping for user-controlled values before they are incorporated into Redis SCAN MATCH expressions. ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges.