GHSA-w6f5-v2h6-g786: Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections

Predis, a PHP Redis client library, has a flaw in how it handles pipelined commands (batched Redis operations) on aggregate connections like clusters and replication setups. An attacker who can control any argument (a value or key) can inject CRLF characters (line breaks) to smuggle arbitrary Redis commands into the connection. On cluster connections this enables remote command injection attacks like wiping data or stealing keys, while on replication connections it causes a denial of service (crash) when any value contains line breaks.