Executive brief
Redocly CLI is a command-line tool used to process OpenAPI and AsyncAPI specifications. The `split` command contains a path traversal vulnerability that allows an attacker to write files outside the intended output directory by crafting a malicious API description file. While the attacker's control over file names and content is limited (constrained to YAML/JSON data and HTTP method names), they can still overwrite or place files at unintended paths on a user's machine who runs the tool against untrusted API specifications.
Technical details
The vulnerability is a path traversal (CWE-22) and external control of file name (CWE-73) issue in Redocly CLI's `split` command. The root cause is insufficient validation of component names and `x-codeSamples` `lang` values in OpenAPI/AsyncAPI descriptions when constructing output file paths. An attacker can inject path traversal sequences (e.g., `../`) into these fields to cause the tool to write files outside the chosen output directory. The vulnerability requires user interaction—a user must run the `split` command against a malicious or untrusted API specification. The attack vector is local, as the tool operates on the user's machine. While the write is constrained (component data is emitted only as YAML/JSON, and code-sample files are named after HTTP methods), an attacker can still place or overwrite files at unintended paths. The issue was fixed in version 1.34.17 and version 2.33.2.
Affected products
- Redocly @redocly/cli < 1.34.17 and >= 2.0.0, < 2.33.2
Timeline
- 2026-09-17: disclosed: CVE and GHSA published
- 2026-09-17: patched: Fixed in @redocly/cli v1.34.17 and v2.33.2