OpenAI Discloses Brotli Remote Code Execution Flaw as Projects Issue Security Updates

OpenAI disclosed a Brotli vulnerability that it said allows unauthenticated remote code execution through malicious compressed data; Brotli has issued new releases and published a CVE, while downstream projects including Node.js have released or are releasing security updates. OpenAI said it found the flaw during a red-teaming exercise. The root cause had been fixed in February, but the security implications were not recognized at the time, and no newer Brotli release was available before the disclosure. According to OpenAI, malicious compressed data could compromise unpatched clients or servers, and downstream software and its users also need updates.

Generated by AI from reports · Updated 57 minutes ago

There is not enough continuous observation data to plot a trend yet.