CVE-2025-46818

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-46818", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-04-30T19:41:58.134Z", "datePublished": "2025-10-03T18:38:57.170Z", "dateUpdated": "2025-10-03T19:14:19.668Z"}, "containers": {"cna": {"title": "Redis: Authenticated users can execute LUA scripts as a different user", "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/redis/redis/security/advisories/GHSA-qrv7-wcrx-q5jp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/redis/redis/security/advisories/GHSA-qrv7-wcrx-q5jp"}, {"name": "https://github.com/redis/redis/commit/45eac0262028c771b6f5307372814b75f49f7a9e", "tags": ["x_refsource_MISC"], "url": "https://github.com/redis/redis/commit/45eac0262028c771b6f5307372814b75f49f7a9e"}, {"name": "https://github.com/redis/redis/releases/tag/8.2.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/redis/redis/releases/tag/8.2.2"}], "affected": [{"vendor": "redis", "product": "redis", "versions": [{"version": "< 8.2.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-03T18:38:57.170Z"}, "descriptions": [{"lang": "en", "value": "Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user. The problem exists in all versions of Redis with LUA scripting. This issue is fixed in version 8.2.2. A workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing LUA scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families."}], "source": {"advisory": "GHSA-qrv7-wcrx-q5jp", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-03T19:02:57.936547Z", "id": "CVE-2025-46818", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-03T19:14:19.668Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-46818", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-03T19:02:57.936547Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-03T19:03:00.679Z"}}], "cna": {"title": "Redis: Authenticated users can execute LUA scripts as a different user", "source": {"advisory": "GHSA-qrv7-wcrx-q5jp", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "redis", "product": "redis", "versions": [{"status": "affected", "version": "< 8.2.2"}]}], "references": [{"url": "https://github.com/redis/redis/security/advisories/GHSA-qrv7-wcrx-q5jp", "name": "https://github.com/redis/redis/security/advisories/GHSA-qrv7-wcrx-q5jp", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/redis/redis/commit/45eac0262028c771b6f5307372814b75f49f7a9e", "name": "https://github.com/redis/redis/commit/45eac0262028c771b6f5307372814b75f49f7a9e", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/redis/redis/releases/tag/8.2.2", "name": "https://github.com/redis/redis/releases/tag/8.2.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user. The problem exists in all versions of Redis with LUA scripting. This issue is fixed in version 8.2.2. A workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing LUA scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-03T18:38:57.170Z"}}}, "cveMetadata": {"cveId": "CVE-2025-46818", "state": "PUBLISHED", "dateUpdated": "2025-10-03T19:14:19.668Z", "dateReserved": "2025-04-30T19:41:58.134Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-10-03T18:38:57.170Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "redis", "vendor": "redis", "versions": [{"status": "affected", "version": "< 8.2.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*", "matchCriteriaId": "C2F4D4F6-6F7C-46BC-B37C-DFAC34B097AC", "versionEndExcluding": "6.2.20", "vulnerable": true}, {"criteria": "cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*", "matchCriteriaId": "4F82BD2A-473F-4F3F-9C80-C6448D07C45D", "versionEndExcluding": "7.2.11", "versionStartIncluding": "7.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*", "matchCriteriaId": "F6E336B8-E000-4EFA-95F8-F2B74A4913F0", "versionEndExcluding": "7.4.6", "versionStartIncluding": "7.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*", "matchCriteriaId": "459EBC07-D37A-44E5-95DB-4C3FD9F008FF", "versionEndExcluding": "8.0.4", "versionStartIncluding": "8.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*", "matchCriteriaId": "CBF13EC1-FE0A-4242-B8D3-2681485DDDF2", "versionEndExcluding": "8.2.2", "versionStartIncluding": "8.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user. The problem exists in all versions of Redis with LUA scripting. This issue is fixed in version 8.2.2. A workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing LUA scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families."}, {"lang": "es", "value": "Redis es una base de datos de c\u00f3digo abierto, en memoria, que persiste en disco. Las versiones 8.2.1 e inferiores permiten a un usuario autenticado usar un script Lua especialmente dise\u00f1ado para manipular diferentes objetos LUA y potencialmente ejecutar su propio c\u00f3digo en el contexto de otro usuario. El problema existe en todas las versiones de Redis con scripting LUA. Este problema est\u00e1 solucionado en la versi\u00f3n 8.2.2. Una soluci\u00f3n alternativa para mitigar el problema sin parchear el ejecutable redis-server es evitar que los usuarios ejecuten scripts LUA. Esto se puede hacer usando ACL para bloquear un script restringiendo tanto las familias de comandos EVAL como FUNCTION."}], "id": "CVE-2025-46818", "lastModified": "2026-10-19T17:10:00.173", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-46818", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-10-03T19:02:57.936547Z", "version": "2.0.3"}}]}, "published": "2025-10-03T19:15:43.330", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/redis/redis/commit/45eac0262028c771b6f5307372814b75f49f7a9e"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/redis/redis/releases/tag/8.2.2"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/redis/redis/security/advisories/GHSA-qrv7-wcrx-q5jp"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "Redis: Redis: Authenticated users can execute LUA scripts as a different user", "id": "2401292", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2401292"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-94", "details": ["Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user. The problem exists in all versions of Redis with LUA scripting. This issue is fixed in version 8.2.2. A workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing LUA scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families.", "A code injection vulnerability in Redis Lua scripting where an authenticated user can craft a Lua script to manipulate objects and potentially execute code in another user\u2019s context."], "mitigation": {"lang": "en:us", "value": "No mitigation is currently available that meets Red Hat Product Security\u2019s standards for usability, deployment, applicability, or stability.\nTo reduce the risk, restricting network access to trusted hosts, enforcing strong authentication and protected-mode, disabling or limiting Lua scripting where possible can be be benificial and apply least-privilege ACLs to reduce who can run scripting commands, keep instances non-public with firewalls/VPCs, and follow Redis hardening guidance to minimize exposure."}, "name": "CVE-2025-46818", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "redis:6/redis", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "redis", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "redis:7/redis", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-10-03T18:38:57Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-46818\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-46818\nhttps://github.com/redis/redis/commit/45eac0262028c771b6f5307372814b75f49f7a9e\nhttps://github.com/redis/redis/releases/tag/8.2.2\nhttps://github.com/redis/redis/security/advisories/GHSA-qrv7-wcrx-q5jp"], "statement": "This rated Moderate as the vulnerability requires authenticated access with scripting rights, high-complexity steps to trigger a specific Lua code path, and typically another user action for cross-context execution. The impact is confined to the Redis process and data, with no availability effect, and can be mitigated via standard ACLs restricting EVAL/FUNCTION or by updating to the fixed release. Unlike \u201cImportant\u201d flaws, it is not remotely exploitable without interaction or across trust boundaries.\nThis flaw exists only in the Redis server implementation; \nRedis client libraries (Python, Node.js, Rust, etc.) are not affected by this vulnerability, and it only exists in the Redis server\u2019s embedded Lua engine where scripts execute. Client libraries merely transmit EVAL/EVALSHA to the server.", "threat_severity": "Moderate"}

{"created": "2025-10-06T14:42:11.624385+00:00", "updated": "2025-10-06T14:42:11.624437+00:00", "vendors": ["redis", "redis$PRODUCT$redis"]}