Redis RediShell Flaw Enables Remote Code Execution via Malicious Lua Scripts
Summary
Wiz reports that Redis CVE-2025-49844 is a critical use-after-free flaw allowing authenticated attackers to escape the Lua sandbox and execute code on the host. Redis and Valkey patches were released October 3; users are urged to update.
Key points
- Wiz says the approximately 13-year-old use-after-free flaw can let an authenticated attacker use a crafted Lua script to escape Redis’s sandbox and execute native code on the host.
- The vulnerability is rated CVSS 10.0; Wiz says it affects Redis and forks including Valkey, and also impacts managed Redis services.
- Wiz estimates about 330,000 Redis instances were internet-exposed and about 60,000 lacked authentication at the time of its analysis.
- Redis and Valkey released patches on October 3, 2025; Wiz urges users to update, prioritizing internet-exposed or unauthenticated instances.
- Recommended safeguards include enabling authentication, restricting network access, disabling unused scripting commands, running Redis with minimal privileges, and monitoring activity.
Article Details
- Vulnerability Types
- Use-after-free memory corruption
- Remote code execution
- Severity
- Critical; CVSS 10.0
- Affected Versions
- Redis: all versions
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Enable Redis authentication using the requirepass directive.
- Disable Lua scripting if it is not needed, or revoke scripting permissions using Redis ACLs.
- Run Redis as a non-root user.
- Restrict Redis access to authorized networks using firewalls or VPCs.
MITRE ATT&CK
T1059 · Command and Scripting InterpreterThe described attack sends a malicious Lua script to Redis, escaping its sandbox to execute code on the host.T1078.004 · Cloud AccountsThe described flow uses stolen IAM tokens to access other cloud services.T1190 · Exploit Public-Facing ApplicationThe described attack exploits CVE-2025-49844 in Redis instances exposed to the internet or internal networks.T1552.004 · Private KeysThe described post-exploitation flow steals SSH keys from the compromised host.
CVE
Vendors
Products
Amazon ElastiCacheIt also impacts managed Redis services such as Amazon ElastiCache, Google Cloud Memorystore, and Azure Cache for Redis.Azure Cache for RedisIt also impacts managed Redis services such as Amazon ElastiCache, Google Cloud Memorystore, and Azure Cache for Redis.Google Cloud MemorystoreIt also impacts managed Redis services such as Amazon ElastiCache, Google Cloud Memorystore, and Azure Cache for Redis.RedisCode Execution (RCE) vulnerability, CVE-2025-49844 which we've dubbed #RediShell, in the widely used Redis in-memory data structure store. The vulnerability has been assigned a CVSS score of 10.0 - the highestValkeyRediShell affects Redis forks, including the popular Valkey project, which released a patch on October 3.