AIKIDO-2026-374560

StackExchange.Redis.Extensions.Core is vulnerable to Code Injection

Pre-CVE Published Aug 5, 2026

CVE Score

Medium

Code Injection

TL;DR

HashGetAllAsyncAtOneTimeAsync builds a Redis Lua script by concatenating the caller-supplied hash key directly into the script text and evaluates it server-side with EVAL. When the hash key contains untrusted characters, the embedded value can break out of the string literal and inject arbitrary Lua that the Redis server executes. The same code also applied the configured key prefix incorrectly, so callers using KeyPrefix read from the wrong hash. The fix removes the Lua script and performs the lookup with a single HMGET, so the key is no longer embedded or executed as script.

How do I fix this?

Upgrade the StackExchange.Redis.Extensions.Core library to the patch version.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your application calls HashGetAllAsyncAtOneTimeAsync with a hash key that can contain externally influenced input.