tag
Redis
RediShell: Redis Lua Scripting Use-After-Free Leading to JOP-Chained Remote Code Execution (CVE-2025-49844)
CVE-2025-49844 ("RediShell") is a use-after-free vulnerability in Redis's embedded Lua scripting engine: a crafted Lua script can manipulate the Lua garbage collector so that a Proto (function prototype) object is freed while a reference to it is still…
Mercator Configuration SSRF Chained to Internal Redis RCE (CVE-2026-49345)
This repository contains two Python PoCs that abuse an unvalidated provider URL parameter in Mercator's ConfigurationController::testProvider endpoint, which the server fetches with libcurl. ssrf2scan.py uses the telnet:// scheme to turn the SSRF into a blind…
AutoGPT Platform Chat Session IDOR / Session Hijack — CVE-2026-30950
The AutoGPT Platform's chat-session API exposes a PATCH /sessions/{sessionid}/assign-user route that lets an authenticated user attach their own account to a chat session record, but the route performs no check that the caller currently owns the session being…
Redis Vector Set Duplicate HNSW Node ID RCE
Redis Vector Set RDB/RESTORE deserialization accepts serialized HNSW graph nodes that reuse the same node ID, but the ID-lookup table only tracks one node per ID while the element dictionary tracks nodes by name, so link validation ends up trusting IDs…
TossUp — TerraMaster TOS Unauthenticated Redis Root RCE + NFS LPE
TossUp is a pair of bugs against TerraMaster TOS NAS devices. The primary issue is that Redis 4.0.10 runs as root and listens on 0.0.0.0:6379 with no authentication — despite /etc/redis.conf containing bind 127.0.0.1, the init script starts Redis as…