CVE-2026-63225

Name of the Vulnerable Software and Affected Versions @redocly/cli versions prior to 2.33.2

Description The split command constructs output paths under the --outDir parameter using untrusted OpenAPI or AsyncAPI component names and x-codeSamples lang values. Because the software fails to verify that the resolved target remains within the selected directory, a description containing ../ traversal segments in these fields can cause the command to place or overwrite files outside the intended directory. This is a path traversal issue, where an attacker can manipulate file paths to write files to unintended locations, although the content is limited to YAML or JSON and filenames for code samples are based on the HTTP method.

Recommendations Update to version 2.33.2. Do not run the split command on API descriptions from untrusted or unreviewed sources. Inspect component names and x-codeSamples lang values for ../ segments to detect exploit attempts.