Description
In Red Discord Bot before version 3.3.11, a RCE exploit has been discovered in the Trivia module: this exploit allows Discord users with specifically crafted usernames to inject code into the Trivia module's leaderboard command. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information. This critical exploit has been fixed on version 3.3.11.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Cog-Creators | Red-DiscordBot | < 3.3.11 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | red-discordbot | < 3.3.11 | 3.3.11 | GHSA-55j9-849x-26h4 |