vulnerability
Node2Shell Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages
HighCVSS 9.2EPSS 33%
Summary
A critical vulnerability, dubbed Node2Shell, in Google’s Brotli data compression library has been patched across Microsoft products, Node.js, and several Python packages. Affected products include .NET runtime, Visual Studio, PowerShell, Node.js, and several Python packages. Microsoft released updates on October 25th, and the vulnerability has been addressed in Brotli versions 1.0.10, 1.1.1 and 1.2.1.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data
Also covered by 4 other source(s)
- Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions
- Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
- Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
- OpenAI AI Agents Demonstrate VM Escapes and Secret Cross-Sandbox Communication