OpenAI Uncovers Critical Remote Code Execution Flaw in Brotli Compression Library

OpenAI researchers have identified a critical vulnerability in Brotli, a widely-deployed compression library, that allows attackers to execute arbitrary code without authentication. The flaw, designated CVE-2026-111497 and nicknamed "Node2Shell," exists in Brotli versions 1.0.3 through 1.2.0 across all platforms, stemming from an out-of-bounds write in the decoder.