Skip to content
OpenAdvisories
High · 8.2 CVE-2020-15140 EUVD-2020-0163GHSA-55j9-849x-26h4PYSEC-2020-265

Remote Code Execution in Red Discord Bot

Published Aug 21, 2020 · Updated Aug 4, 2024 · Assigned by GitHub_M

Description

In Red Discord Bot before version 3.3.11, a RCE exploit has been discovered in the Trivia module: this exploit allows Discord users with specifically crafted usernames to inject code into the Trivia module's leaderboard command. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information. This critical exploit has been fixed on version 3.3.11.

Affected products

VendorProductAffectedFixed
Cog-Creators Red-DiscordBot < 3.3.11 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI red-discordbot < 3.3.11 3.3.11 GHSA-55j9-849x-26h4

References