Subverting the Lua environment in Redis

In 2015 I performed an offensive security analysis of Redis, focusing on its Lua scripting capabilities and related execution environment. This post contains a brief summary of my findings, which at the time have been reported and discussed with project maintainers.