OpenAI uncovers remote code execution flaw in Brotli compression library

OpenAI went looking for security holes and found a big one in an unexpected place: Brotli, a widely used compression library that quietly sits inside a long list of software projects. The flaw allows remote code execution. That means an attacker could potentially run their own commands on a target machine. OpenAI disclosed it to affected projects, and Node.js is among those now pushing out security updates. What OpenAI found The vulnerability is tracked as CVE-2026-111497 and carries a nickname, “Node2Shell,” because every serious bug apparently needs branding now. OpenAI researchers reportedly turned it up during internal security assessments of the Brotli decoder. The problem lives in that unsealing step. Researchers traced it to an out-of-bounds write, which can be triggered by compressed input that has been crafted with malicious intent. A booby-trapped package can trick the decoder into writing data into memory it was never supposed to touch. Once an attacker can scribble outside the lines like that, running their own code is often the next stop. The flaw is rated high severity with a critical CVSS score of 9.2. CVSS is the industry’s standard scale for grading vulnerabilities...