CVE-2026-63225: Redocly CLI: Path traversal when using `split` command
Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to @redocly/cli 2.33.2, the split command constructs output paths under --outDir from untrusted OpenAPI or AsyncAPI component names and x-codeSamples lang values without verifying that the resolved target remains inside the selected directory. A description containing literal ../ traversal segments in those fields can cause the split command to place or overwrite files outside --outDir. Component data remains constrained to YAML or JSON, and code-sample filenames remain based on the HTTP method, so this is not an unrestricted arbitrary-content file write. This issue is fixed in @redocly/cli version 2.33.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@redocly/clito a version that resolves this vulnerability.Fixed in 2.33.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of @redocly/cli versions earlier than 2.33.2 are exposed when they run the split command on OpenAPI or AsyncAPI descriptions whose component names or x-codeSamples lang values are attacker-controlled or otherwise untrusted.
What must an attacker control to exploit it?
The attacker needs to provide a description containing literal ../ traversal segments in component names or x-codeSamples lang values, and a user must run the split command against that description. The attack is local and requires user interaction, as reflected by the AV:L and UI:R vector.
How much control does this give over written files?
It can cause files to be placed or overwritten outside the selected --outDir, but it is not an unrestricted arbitrary-content file write. Component output remains limited to YAML or JSON, and code-sample filenames are based on the HTTP method.
What is the remediation?
Upgrade @redocly/cli to version 2.33.2, which fixes the path validation issue. If upgrading is not immediately possible, do not run split on untrusted API descriptions and review component names and x-codeSamples lang values for literal ../ segments before processing.