OpenAI Finds Remote-Code Flaw in Brotli Used by Node.js, Bun and Envoy

OpenAI’s red-team testing found an unauthenticated remote-code-execution flaw in Brotli, a widely used compression library built into Node.js, Bun and Envoy, putting unpatched systems at risk of takeover. OpenAI said attackers can exploit the flaw by sending malicious compressed data to an unpatched server. A malicious server could also take control of a client that accepts compressed data. The issue requires no authentication, so an attacker does not need an account on the target system to exploit it.

Source: TokenPost