Remote Code Execution (RCE) Exploit on Cross Site Scripting (XSS) Vulnerability
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
Red Discord Bot Dashboard is an easy-to-use interactive web dashboard to control your Redbot. In Red Discord Bot before version 0.1.7a an RCE exploit has been discovered. This exploit allows Discord users with specially crafted Server names and Usernames/Nicknames to inject code into the webserver front-end code. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information. This high severity exploit has been fixed on version 0.1.7a. There are no workarounds, bot owners must upgrade their relevant packages (Dashboard module and Dashboard webserver) in order to patch this issue.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cog-Creators | Red-Dashboard | before 0.1.7a | 0.1.7a | Patch available | CNA |
| — | red-dashboard (PyPI) | before 0.1.7a | 0.1.7a | Patch available | GHSA-hm45-mgqm-gjm4 |
- Red-Dashboard VendorCog-Creators Affected before 0.1.7a Fixed in 0.1.7a Patch available CNA
- red-dashboard (PyPI) Vendor— Affected before 0.1.7a Fixed in 0.1.7a Patch available GHSA-hm45-mgqm-gjm4
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cogboard:red-dashboard:0.1.2:alpha0:*:*:*:*:*:* | 0.1.2 alpha0 | Vulnerable | Cog-Creators |
| cpe:2.3:a:cogboard:red-dashboard:0.1.3:alpha0:*:*:*:*:*:* | 0.1.3 alpha0 | Vulnerable | Cog-Creators |
| cpe:2.3:a:cogboard:red-dashboard:0.1.4:alpha0:*:*:*:*:*:* | 0.1.4 alpha0 | Vulnerable | Cog-Creators |
| cpe:2.3:a:cogboard:red-dashboard:0.1.5:alpha0:*:*:*:*:*:* | 0.1.5 alpha0 | Vulnerable | Cog-Creators |
| cpe:2.3:a:cogboard:red-dashboard:0.1.6:alpha0:*:*:*:*:*:* | 0.1.6 alpha0 | Vulnerable | Cog-Creators |
- cpe:2.3:a:cogboard:red-dashboard:0.1.2:alpha0:*:*:*:*:*:* Versions 0.1.2 alpha0 Vulnerable ·Cog-Creators
- cpe:2.3:a:cogboard:red-dashboard:0.1.3:alpha0:*:*:*:*:*:* Versions 0.1.3 alpha0 Vulnerable ·Cog-Creators
- cpe:2.3:a:cogboard:red-dashboard:0.1.4:alpha0:*:*:*:*:*:* Versions 0.1.4 alpha0 Vulnerable ·Cog-Creators
- cpe:2.3:a:cogboard:red-dashboard:0.1.5:alpha0:*:*:*:*:*:* Versions 0.1.5 alpha0 Vulnerable ·Cog-Creators
- cpe:2.3:a:cogboard:red-dashboard:0.1.6:alpha0:*:*:*:*:*:* Versions 0.1.6 alpha0 Vulnerable ·Cog-Creators
Remediation
- Fix · CNA Red-Dashboard (Cog-Creators) Fixed in 0.1.7a
- Fix · GHSA-hm45-mgqm-gjm4 red-dashboard (PyPI) Fixed in 0.1.7a Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-26249
- 2026-10-03 Alias added: GHSA-hm45-mgqm-gjm4
References
Patch 3
Sources
- CVE-2020-26249 · CVE Program
- CVE-2020-26249 · NVD
- FIRST EPSS
- GHSA-hm45-mgqm-gjm4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences