Answer in brief
CVE-2026-63225 records a Medium severity (CVSS 4.4) vulnerability in Redocly CLI: Path traversal when using `split` command. The current sources do not mark it as known exploited. The current feed maps Redocly/redocly-cli (generic), @redocly/cli (npm), @redocly/cli (npm), @redocly/cli (npm) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 4.4. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Redocly/redocly-cli (generic), @redocly/cli (npm), @redocly/cli (npm), @redocly/cli (npm) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Redocly/redocly-cligeneric | <1.34.17 || >=2.0.0 <2.33.2 | 1.34.17, 2.33.2 |
| @redocly/clinpm | <1.34.17 | 1.34.17 |
| @redocly/clinpm | >=2.0.0,<2.33.2 | 2.33.2 |
| @redocly/clinpm | >=0 <1.34.17 | 1.34.17 |
| @redocly/clinpm | >=2.0.0 <2.33.2 | 2.33.2 |
Published upstream
Sep 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 30, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 16, 2026
Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to @redocly/cli 2.33.2, the split command constructs output paths under --outDir from untrusted OpenAPI or AsyncAPI component names and x-codeSamples lang values without verifying that the resolved target remains inside the selected directory. A description containing literal ../ traversal segments in those fields can cause the split command to place or overwrite files outside --outDir. Component data remains constrained to YAML or JSON, and code-sample filenames remain based on the HTTP method, so this is not an unrestricted arbitrary-content file write. This issue is fixed in @redocly/cli version 2.33.2.
Quoted source text, attributed separately from HOL analysis.