--- title: "Security digest: October 3, 2025" url: https://erroneo.us/security/2025-10-03/ description: "October 3, 2025 vulnerability digest: 1 brief (RediShell); 1 critical advisory (npm). What to patch and who can relax." type: security-digest-day section: "Security Digest" date_published: 2025-10-03 date_modified: 2026-10-21 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: October 3, 2025 1 editorial brief and 1 critical advisory. ## Take stock - Patch this week: RediShell . Anyone self-hosting Redis with Lua scripting (the default) below the fixed versions, first of all instances that are internet-reachable or have no requirepass/ACLs. - npm: 1 critical advisory ( flowise ). Check with npm audit (or: npm ls ) . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Editorial briefs - **Patch this week** [RediShell: 13-Year-Old Lua Use-After-Free RCE in Redis](https://erroneo.us/security/briefs/redishell-redis-lua-rce-cve-2025-49844/index.md): Exploitation needs an authenticated session, so properly locked-down Redis can be patched in a normal urgent window; instances reachable without a password are effectively unauthenticated RCE and should be fixed today. ## Known exploited (CISA KEV) None. ## Critical advisories - [CVE-2025-50538](https://erroneo.us/security/cve/CVE-2025-50538/index.md) Flowise is vulnerable to stored XSS via "View Messages" allows credential theft in FlowiseAI admin panel — npm flowise < 3.0.8 → 3.0.8 --- Source page: https://erroneo.us/security/2025-10-03/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt