CVE-2024-43404

Katalog CVE

CVSS 9.8 · Critical EPSS 1,1%

Kerentanan Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') pada megacord megabot. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

MEGABOT is a fully customized Discord bot for learning and fun. The `/math` command and functionality of MEGABOT versions < 1.5.0 contains a remote code execution vulnerability due to a Python `eval()`. The vulnerability allows an attacker to inject Python code into the `expression` parameter when using `/math` in any Discord channel. This vulnerability impacts any discord guild utilizing MEGABOT. This vulnerability was fixed in release version 1.5.0.

Rincian

Terbit di NVD

20 Agustus 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 65,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/NicPWNs/MEGABOT/security/advisories/GHSA-vhxp-4hwq-w3p2 patch · advisory vendor
• https://github.com/NicPWNs/MEGABOT/commit/71e79e5581ea36313700385b112d863053fb7ed6 patch
• https://github.com/NicPWNs/MEGABOT/pull/138 issue tracking · patch
• https://github.com/NicPWNs/MEGABOT/issues/137 issue tracking
• https://github.com/NicPWNs/MEGABOT/releases/tag/v1.5.0 release notes