GHSA-q324-q795-2q5p
Path traversal when using `preview-docs` when working dir contains files with question mark `?` in name
Impact
preview-docs command allows path traversal if current working dir contains files with question mark ? in name and attacker knows the name.
Patches
It was patched starting from 1.0.0-beta.59
Workarounds
Do not run openapi-cli preview-docs command in the folder which contains files with question mark ? in name.
References
https://github.com/Redocly/openapi-cli/pull/347
For more information
If you have any questions or comments about this advisory:
- Open an issue in @redocly/openapi-cli
- Email us at security@redocly.com
What each source reports
GitHub AdvisoriesNo score
Path traversal when using `preview-docs` when working dir contains files with question mark `?` in name
Impact
preview-docs command allows path traversal if current working dir contains files with question mark ? in name and attacker knows the name.
Patches
It was patched starting from 1.0.0-beta.59
Workarounds
Do not run openapi-cli preview-docs command in the folder which contains files with question mark ? in name.
References
https://github.com/Redocly/openapi-cli/pull/347
For more information
If you have any questions or comments about this advisory:
- Open an issue in @redocly/openapi-cli
- Email us at security@redocly.com
- Record
GHSA-q324-q795-2q5p- Updated
- 2026-11-02
OSVNo score
Path traversal when using `preview-docs` when working dir contains files with question mark `?` in name
Impact
preview-docs command allows path traversal if current working dir contains files with question mark ? in name and attacker knows the name.
Patches
It was patched starting from 1.0.0-beta.59
Workarounds
Do not run openapi-cli preview-docs command in the folder which contains files with question mark ? in name.
References
https://github.com/Redocly/openapi-cli/pull/347
For more information
If you have any questions or comments about this advisory:
- Open an issue in @redocly/openapi-cli
- Email us at security@redocly.com
- Record
GHSA-q324-q795-2q5p- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
@redocly/openapi-clinpm | through 1.0.0-beta.58 | 1.0.0-beta.59 |
@redocly/openapi-clinpm | before 1.0.0-beta.59 | 1.0.0-beta.59 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-q324-q795-2q5p is a vulnerability with no CVSS score yet in @redocly/openapi-cli, published October 12, 2021. No source lists public exploit code. Fixed in @redocly/openapi-cli 1.0.0-beta.59.