Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

red-dashboard

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.1PyPIPublished

    Remote Code Execution (RCE) Exploit on Cross Site Scripting (XSS) Vulnerability

    CVE-2020-26249 · GHSA-hm45-mgqm-gjm4

    Affected
    • PyPI red-dashboard <= 0.1.6a0
    Fixed in
    0.1.7a0· Vendor fix available
    Issue
    Impact A RCE exploit has been discovered in the Red Discord Bot - Dashboard Webserver: this exploit allows Discord users with specially crafted Server names and Usernames/Nicknames to inject code into the webserver front-end code. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information. Patches This high severity exploit has been fixed on version 0.1.7a. Workarounds There are no workarounds, bot owners must upgrade their relevant packages (Dashboard module and Dashboard webserver) in order to patch this issue References - 99d88b8 - a6b9785 For more information If you have any questions or comments about this advisory: Open an issue in Cog-Creators/Red-Dashboard Over on the official Red Server or at the Third Party Server Toxic Layer

    Recommended action: Upgrade to 0.1.7a0 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →