Redis patches 13-Year-Old Lua flaw enabling Remote Code Execution

Redis has disclosed a critical remote code execution flaw in Lua scripting, tracked as CVE-2025-49844 and nicknamed “RediShell,” with a CVSS score of 10.0, arising from a use-after-free in the Lua garbage collector that can be exploited by an authenticated Lua script to escape the Lua sandbox and run arbitrary code on the Redis host.

The vulnerability affects all Redis versions with Lua scripting, and researchers describe an attack chain in which a malicious script can trigger the flaw, gain code execution, and potentially exfiltrate data or move laterally across cloud environments. The disclosure timeline notes that Wiz reported the issue to Redis on 16 May 2025, with a blog post published on 6 October 2025 and Redis issuing a security bulletin on 3 October 2025 assigning CVE-2025-49844.

Redis issued fixes in versions 6.2.20, 7.2.11, 7.4.6, 8.0.4, and 8.2.2 on 3 October 2025, and as a workaround recommends restricting EVAL and EVALSHA via ACLs and limiting Lua script execution to trusted users. Given Redis’s estimated presence in about 75% of cloud environments, organisations are advised to prioritise securing internet-exposed instances. according to Wiz