OpenAI discloses unauthenticated RCE in Brotli compression library
What happened
On October 24, OpenAI published an unauthenticated remote code execution vulnerability in the Brotli compression library that it found during a red team exercise and has disclosed. The report says an attacker needs no user account: sending or replying with malicious compressed data can run code on affected systems. The impact covers software that embeds Brotli, including Node.js, Bun and Envoy. Unpatched systems that accept compressed input can be taken over by a malicious peer. The report confirms the finding and disclosure but gives no patched version or fix timeline.
Written by AI from the coverage · updated 1 hour ago
Coverage
Follow the reports to see the story from different sides.
- AI HOT · IndustryOpenAI 红队演练发现并披露 Brotli 未认证远程代码执行漏洞
OpenAI 公布其在红队演练中发现 Brotli 压缩库存在未认证远程代码执行漏洞，并已披露。攻击者无需创建用户账号，即可通过发送或回复恶意压缩数据在受影响系统上执行代码。影响涉及 Node.js、Bun、Envoy 等内嵌 Brotli 的软件，未打补丁且接受压缩输入的系统可能被恶意对端接管。
Heat over time
Not enough continuous observations to draw a trend yet.