OpenAI uncovers remote code execution flaw in Brotli compression library
Photo: Crypto Briefing
The bug, dubbed Node2Shell, has pushed Node.js, Bun, Envoy and Python package maintainers to ship security updates OpenAI went looking for security holes and found a big one in an unexpected place: Brotli, a widely used compression library that quietly sits inside a long list of software projects. The flaw allows remote code execution. That means an attacker could potentially run their own commands on a target machine. OpenAI disclosed it to affected projects, and Node.js is among those now pushing out security updates.
Source: Crypto Briefing
