Redocly vulnerabilities
We track 3 vulnerabilities in Redocly products across 2 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on September 16, 2026.
Latest Redocly vulnerabilities
- 7.8 High severity
redocly-cli: Improper Control of Generation of Code
Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to version 2.33.0 of @redocly/respect-core and @redocly/cli, the respect command dynamically evaluates $faker runtime expressions in Arazzo descriptions. A crafted express
- 7.5 High severity
Redoc: Improperly Controlled Modification of Object Prototype Attributes
A prototype pollution in the component Module.mergeObjects (redoc/bundles/redoc.lib.js:2) of redoc <= 2.2.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
- 9.8 Critical severity
redoc: Improperly Controlled Modification of Object Prototype Attributes
Prototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and cause other impacts via the function mergeObjects.