Impact "preview-docs" command allows path traversal if current working dir contains files with question mark "?" in name and attacker knows the name. Patches It was patched starting from 1.0.0-beta.59 Workarounds Do not run openapi-cli preview-docs command in the folder which contains files with question mark "?" in name. References https://github.com/Redocly/openapi-cli/pull/347 For more information If you have any questions or comments about this advisory: * Open an issue in "@redocly/openapi-cli" (https://github.com/Redocly/openapi-cli) * Email us at "security@redocly.com" (mailto:security@redocly.com)