CVE-2025-46818 (GCVE-0-2025-46818)

Vulnerability from cvelistv5 – Published: 2025-10-03 18:38 – Updated: 2025-10-03 19:14
VLAI
Title
Redis: Authenticated users can execute LUA scripts as a different user
Summary
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user. The problem exists in all versions of Redis with LUA scripting. This issue is fixed in version 8.2.2. A workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing LUA scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families.
Severity
6 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-03 19:02 UTC
CWE
  • CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7613 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
redis redis Affected: < 8.2.2
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-46818",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-03T19:02:57.936547Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-03T19:14:19.668Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "redis",
          "vendor": "redis",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 8.2.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user. The problem exists in all versions of Redis with LUA scripting. This issue is fixed in version 8.2.2. A workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing LUA scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-03T18:38:57.170Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/redis/redis/security/advisories/GHSA-qrv7-wcrx-q5jp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/redis/redis/security/advisories/GHSA-qrv7-wcrx-q5jp"
        },
        {
          "name": "https://github.com/redis/redis/commit/45eac0262028c771b6f5307372814b75f49f7a9e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redis/redis/commit/45eac0262028c771b6f5307372814b75f49f7a9e"
        },
        {
          "name": "https://github.com/redis/redis/releases/tag/8.2.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redis/redis/releases/tag/8.2.2"
        }
      ],
      "source": {
        "advisory": "GHSA-qrv7-wcrx-q5jp",
        "discovery": "UNKNOWN"
      },
      "title": "Redis: Authenticated users can execute LUA scripts as a different user"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-46818",
    "datePublished": "2025-10-03T18:38:57.170Z",
    "dateReserved": "2025-04-30T19:41:58.134Z",
    "dateUpdated": "2025-10-03T19:14:19.668Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-46818",
      "date": "2026-10-19",
      "epss": "0.00727",
      "percentile": "0.53312"
    },
    "microsoft_vex": {
      "current_release_date": "2025-12-11T01:38:13.000Z",
      "cve": "CVE-2025-46818",
      "id": "msrc_CVE-2025-46818",
      "initial_release_date": "2025-10-02T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Redis: Authenticated users can execute LUA scripts as a different user",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-46818.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "redis",
                "vendor": "redis",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 8.2.2"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C2F4D4F6-6F7C-46BC-B37C-DFAC34B097AC",
                    "versionEndExcluding": "6.2.20",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4F82BD2A-473F-4F3F-9C80-C6448D07C45D",
                    "versionEndExcluding": "7.2.11",
                    "versionStartIncluding": "7.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F6E336B8-E000-4EFA-95F8-F2B74A4913F0",
                    "versionEndExcluding": "7.4.6",
                    "versionStartIncluding": "7.4.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "459EBC07-D37A-44E5-95DB-4C3FD9F008FF",
                    "versionEndExcluding": "8.0.4",
                    "versionStartIncluding": "8.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CBF13EC1-FE0A-4242-B8D3-2681485DDDF2",
                    "versionEndExcluding": "8.2.2",
                    "versionStartIncluding": "8.2.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user. The problem exists in all versions of Redis with LUA scripting. This issue is fixed in version 8.2.2. A workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing LUA scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families."
          },
          {
            "lang": "es",
            "value": "Redis es una base de datos de c\u00f3digo abierto, en memoria, que persiste en disco. Las versiones 8.2.1 e inferiores permiten a un usuario autenticado usar un script Lua especialmente dise\u00f1ado para manipular diferentes objetos LUA y potencialmente ejecutar su propio c\u00f3digo en el contexto de otro usuario. El problema existe en todas las versiones de Redis con scripting LUA. Este problema est\u00e1 solucionado en la versi\u00f3n 8.2.2. Una soluci\u00f3n alternativa para mitigar el problema sin parchear el ejecutable redis-server es evitar que los usuarios ejecuten scripts LUA. Esto se puede hacer usando ACL para bloquear un script restringiendo tanto las familias de comandos EVAL como FUNCTION."
          }
        ],
        "id": "CVE-2025-46818",
        "lastModified": "2026-10-19T17:10:00.173",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "NONE",
                "baseScore": 6.0,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 0.8,
              "impactScore": 5.2,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.3,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.3,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-46818",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-03T19:02:57.936547Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-10-03T19:15:43.330",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/redis/redis/commit/45eac0262028c771b6f5307372814b75f49f7a9e"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Release Notes"
            ],
            "url": "https://github.com/redis/redis/releases/tag/8.2.2"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://github.com/redis/redis/security/advisories/GHSA-qrv7-wcrx-q5jp"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-94"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-28T08:23:55+00:00",
      "cve": "CVE-2025-46818",
      "id": "CVE-2025-46818",
      "initial_release_date": "2025-10-03T18:38:57.170000+00:00",
      "product_status:fixed": "147",
      "product_status:known_not_affected": "147",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Redis: Redis: Authenticated users can execute LUA scripts as a different user",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-46818.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-46818",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-10-03T19:02:57.936547Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-10-03T19:03:00.679Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "redis",
              "vendor": "redis",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 8.2.2"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user. The problem exists in all versions of Redis with LUA scripting. This issue is fixed in version 8.2.2. A workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing LUA scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "NONE",
                "baseScore": 6,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-94",
                  "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-10-03T18:38:57.170Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/redis/redis/security/advisories/GHSA-qrv7-wcrx-q5jp",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/redis/redis/security/advisories/GHSA-qrv7-wcrx-q5jp"
            },
            {
              "name": "https://github.com/redis/redis/commit/45eac0262028c771b6f5307372814b75f49f7a9e",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/redis/redis/commit/45eac0262028c771b6f5307372814b75f49f7a9e"
            },
            {
              "name": "https://github.com/redis/redis/releases/tag/8.2.2",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/redis/redis/releases/tag/8.2.2"
            }
          ],
          "source": {
            "advisory": "GHSA-qrv7-wcrx-q5jp",
            "discovery": "UNKNOWN"
          },
          "title": "Redis: Authenticated users can execute LUA scripts as a different user"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2025-46818",
        "datePublished": "2025-10-03T18:38:57.170Z",
        "dateReserved": "2025-04-30T19:41:58.134Z",
        "dateUpdated": "2025-10-03T19:14:19.668Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.