Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more
Security researchers have identified a remote code execution flaw in the Brotli decompression library, affecting implementations in Node.js, Python and several other platforms. The vulnerability, dubbed Broccoli2Shell, allows attackers to execute arbitrary code when processing crafted compressed data. Vendors have been notified, and patches are being prepared to mitigate the risk across affected software. Users are advised to update their packages promptly.