OpenAI: Red Team Testing Discovers Brotli Compressed Inventory Vulnerability in Remote Code Execution OpenAI posted that during recent Red Team exercises, it discovered a vulnerability in the widely used compression library Brotli that allows for remote code execution without authentication. This library is built into software such as Node.js, Bun, and Envoy. Attackers can take over unpatched servers by sending malicious compressed data, or they can take over clients receiving compressed data through malicious servers. OpenAI stated that the root cause of the issue was fixed in the Brotli source code in February of this year, but it was not identified as a security vulnerability at the time, and the software with the built-in library needs to be updated synchronously. According to The Hacker News, the vulnerability number is CVE-226-111497, and a fixed version of Node.js was released on October 21st.