Remote Code Execution in Red Discord Bot
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.
Summary
Red Discord Bot before versions 3.3.12 and 3.4 has a Remote Code Execution vulnerability in the Streams module. This exploit allows Discord users with specifically crafted "going live" messages to inject code into the Streams module's going live message. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information. As a workaround, unloading the Trivia module with `unload streams` can render this exploit not accessible. It is highly recommended updating to 3.3.12 or 3.4 to completely patch this issue.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cog-Creators | Red-DiscordBot | before 3.3.12 | 3.3.12 | Patch available | CNA |
| — | Red-DiscordBot (PyPI) | before 3.3.12 | 3.3.12 | Patch available | GHSA-7257-96vg-qf6x |
- Red-DiscordBot VendorCog-Creators Affected before 3.3.12 Fixed in 3.3.12 Patch available CNA
- Red-DiscordBot (PyPI) Vendor— Affected before 3.3.12 Fixed in 3.3.12 Patch available GHSA-7257-96vg-qf6x
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cogboard:red_discord_bot:*:*:*:*:*:*:*:* | up to 3.3.11 | Vulnerable | Cog-Creators |
- cpe:2.3:a:cogboard:red_discord_bot:*:*:*:*:*:*:*:* Versions up to 3.3.11 Vulnerable ·Cog-Creators
Remediation
- Fix · CNA Red-DiscordBot (Cog-Creators) Fixed in 3.3.12
- Fix · GHSA-7257-96vg-qf6x Red-DiscordBot (PyPI) Fixed in 3.3.12 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-15147
- 2026-10-03 Alias added: GHSA-7257-96vg-qf6x
References
Patch 2
Advisory 2
More Cog-Creators Red Discord Bot vulnerabilities
- TI-2020-11913 Remote Code Execution in Red Discord Bot CVSS 3.1CRITICAL 9.6
- TI-2020-12048 Unauthorized privilege escalation in Mod module CVSS 3.1HIGH 7.7
Sources
- CVE-2020-15147 · CVE Program
- CVE-2020-15147 · NVD
- FIRST EPSS
- GHSA-7257-96vg-qf6x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences