CVE-2026-63325

Name of the Vulnerable Software and Affected Versions @redocly/respect-core versions prior to 2.33.0 @redocly/cli versions prior to 2.33.0

Description The respect command dynamically evaluates $faker runtime expressions in Arazzo descriptions. A crafted expression can traverse constructor, prototype, or proto properties within the get-value-from-context.ts file to reach the JavaScript Function constructor. This allows the execution of arbitrary code with the privileges of the CLI process, potentially enabling the execution of shell commands or the reading of CI secrets, when a user processes an untrusted description.

Recommendations Update @redocly/respect-core to version 2.33.0. Update @redocly/cli to version 2.33.0.