CVE-2025-46818

A code injection vulnerability in Redis Lua scripting where an authenticated user can craft a Lua script to manipulate objects and potentially execute code in another user’s context.

This rated Moderate as the vulnerability requires authenticated access with scripting rights, high-complexity steps to trigger a specific Lua code path, and typically another user action for cross-context execution. The impact is confined to the Redis process and data, with no availability effect, and can be mitigated via standard ACLs restricting EVAL/FUNCTION or by updating to the fixed release. Unlike “Important” flaws, it is not remotely exploitable without interaction or across trust boundaries.

This flaw exists only in the Redis server implementation;

Redis client libraries (Python, Node.js, Rust, etc.) are not affected by this vulnerability, and it only exists in the Redis server’s embedded Lua engine where scripts execute. Client libraries merely transmit EVAL/EVALSHA to the server.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.

To reduce the risk, restricting network access to trusted hosts, enforcing strong authentication and protected-mode, disabling or limiting Lua scripting where possible can be be benificial and apply least-privilege ACLs to reduce who can run scripting commands, keep instances non-public with firewalls/VPCs, and follow Redis hardening guidance to minimize exposure.