CVE-2025-46818: 
Redis vulnerability analysis and mitigation

Redis versions 8.2.1 and below contain a vulnerability (CVE-2025-46818) that allows an authenticated user to execute Lua scripts in the context of another user. The vulnerability was discovered and disclosed on October 3, 2025, affecting all versions of Redis with Lua scripting capabilities (Redis Release, GitHub Advisory).

The vulnerability stems from insufficient protection of Lua objects, allowing authenticated users to manipulate different LUA objects through specially crafted Lua scripts. The issue has been assigned a CVSS v3.1 score of 6.0 (Medium) with the vector string CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N. The vulnerability is classified as CWE-94: Improper Control of Generation of Code ('Code Injection') (GitHub Advisory).

The vulnerability allows authenticated users to potentially execute code in the context of another user, leading to privilege escalation within Redis instances. This could result in unauthorized access to data and potential manipulation of Redis operations with elevated privileges (GitHub Advisory).

The vulnerability has been fixed in Redis version 8.2.2. For users unable to update immediately, a workaround is available by preventing users from executing Lua scripts altogether. This can be implemented using ACL to block script execution by restricting both the EVAL and FUNCTION command families (Redis Release, GitHub Advisory).