AIKIDO-2026-374560

StackExchange.Redis.Extensions.Core is vulnerable to Code Injection

Code Injection Pre-CVE Published 2 days ago

Medium Risk

This Affects:

StackExchange.Redis.Extensions.Core

10.1.0 - 13.0.0

Fixed in 13.0.1

Are you affected? Scan for Free

TL;DR

HashGetAllAsyncAtOneTimeAsync builds a Redis Lua script by concatenating the caller-supplied hash key directly into the script text and evaluates it server-side with EVAL. When the hash key contains untrusted characters, the embedded value can break out of the string literal and inject arbitrary Lua that the Redis server executes. The same code also applied the configured key prefix incorrectly, so callers using KeyPrefix read from the wrong hash. The fix removes the Lua script and performs the lookup with a single HMGET, so the key is no longer embedded or executed as script.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your application calls HashGetAllAsyncAtOneTimeAsync with a hash key that can contain externally influenced input.