Medium, CVSS 6.5npmAmendedPublished
Cocotais Bot has builtin .echo command injection
CVE-2025-47948 · GHSA-mj2c-8hxf-ffvq
- Affected
- npm cocotais-bot >= 1.5.0-test2-hotfix, < 1.6.2
- Fixed in
- 1.6.2· Vendor fix available
- Issue
- A command echoing feature in the framework allows users to indirectly trigger privileged behavior by injecting special platform tags. Specifically, an unauthorized user can use the /echo <qqbot-at-everyone / command to cause the bot to send a message that mentions all members in the chat, bypassing any permission controls. This can lead to spam, disruption, or abuse of notification systems. Details The framework provides a command /echo that causes the bot to repeat any user-provided message verbatim in the group chat. However, the bot fails to sanitize or filter platform-specific control elements such as <qqbot-at-everyone /, which, when included in a message, mentions everyone (i.e., @全体成员). While normal users are forbidden from using this tag in normal chats, the bot, which has higher privileges, is allowed to do so. Since the /echo command blindly echoes any content, a user can exploit this by sending: The bot will then send a message containing <qqbot-at-everyone /,…
Recommended action: Upgrade to 1.6.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.