Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact Due to a bug in Red's Core API, 3rd-party cogs using the @commands.canmanagechannel() command permission check without additional permission controls may authorize a user to run a command even when that user doesn't have permissions to manage a channel. None of the core commands or core cogs are affected. The maintainers of the project are not aware of any public 3rd-party cog utilizing this API at the time of writing this advisory. The @commands.modorcanmanagechannel(), @commands.adminorcanmanagechannel(), and @commands.guildownerorcanmanagechannel() command permission checks are unaffected. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/AU:Y/R:U/RE:L Patches The problem was patched in PR #6398 and later released in version 3.5.10. Workarounds Any cog using the @commands.canmanagechannel() command permission check should be unloaded until an upgrade to a patched version can be performed. References…
Recommended action: Upgrade to 3.5.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An unauthorized privilege escalation exploit has been discovered in the Mod module: this exploit allows Discord users with a high privilege level within the guild to bypass hierarchy checks when the application is in a specific condition that is beyond that user's control. By abusing this exploit, it's possible to perform destructive actions within the guild the user has high privileges in. Patches This exploit has been fixed on version & 3.4.1. Workarounds Unloading the Mod module with unload mod or, disabling the massban command with command disable global massban can render this exploit not accessible. We still highly recommend updating to 3.4.1 to completely patch this issue. References https://github.com/Cog-Creators/Red-DiscordBot/commit/726bfd38adfdfaef760412a68e01447b470f438b For more information If you have any questions or comments about this advisory: Open an issue in Cog-Creators/Red-DiscordBot Over on our Discord server
Recommended action: Upgrade to 3.4.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A RCE exploit has been discovered in the Streams module: this exploit allows Discord users with specifically crafted "going live" messages to inject code into the Streams module's going live message. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information. Patches This critical exploit has been fixed on version 3.3.12 & 3.4. Workarounds Unloading the Streams module with unload streams can render this exploit not accessible. We still highly recommend updating to 3.3.12 or 3.4 to completely patch this issue. References https://github.com/Cog-Creators/Red-DiscordBot/pull/4183 For more information If you have any questions or comments about this advisory: Open an issue in Cog-Creators/Red-DiscordBot Over on our Discord server
Recommended action: Upgrade to 3.3.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A RCE exploit has been discovered in the Trivia module: this exploit allows Discord users with specifically crafted usernames to inject code into the Trivia module's leaderboard command. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information. Patches This critical exploit has been fixed on version 3.3.11. Workarounds Unloading the Trivia module with unload trivia can render this exploit not accessible. We still highly recommend updating to 3.3.11 to completely patch this issue. References https://github.com/Cog-Creators/Red-DiscordBot/pull/4175 For more information If you have any questions or comments about this advisory: Open an issue in Cog-Creators/Red-DiscordBot Over on our Discord server
Recommended action: Upgrade to 3.3.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.