Saint RediShell, Who Woke Lua's Garbage Collector

Patron of caches exposed to the Internet without a password, Lua scripts, and bugs turning thirteen.

Life

In early October 2025 Redis fixed, and Wiz described, a use-after-free hidden in the Lua interpreter embedded in the database: a crafted script could manipulate the garbage collector until it escaped the sandbox and ran code on the server. The flaw, which Wiz took to Pwn2Own Berlin, had existed for about thirteen years and received a CVSS of 10. It needed an authenticated user, but Wiz counted tens of thousands of exposed instances that asked for no password at all.

Prayer

O Saint RediShell, who climbs down into Lua's rubbish and comes back up with a shell, let our Redis servers ask for at least one password. Amen.

How to celebrate

Celebrated by upgrading Redis to 8.2.2, or using ACLs to forbid EVAL and EVALSHA to anyone who does not need them.

Rummage through the rubbish and you'll always find something.