Bot Framework SDK Information Disclosure Vulnerability
Priority LOW 27CWE-287Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass, Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-287 and CWE-200.
Summary
Bot Framework SDK Information Disclosure Vulnerability
Why it matters now
EPSS 0.01074 65th percentileScored 2026-11-07
Fix Fixed Bot Framework SDK for .NET Framework (Microsoft): publicationBot Framework SDK for JavaScript (Microsoft): publication+2 more products
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Microsoft | Bot Framework SDK for .NET Framework | 4.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Bot Framework SDK for JavaScript | 4.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Bot Framework SDK for Python | 4.0.0 to before publication | publication | Patch available | CNA |
| — | botframework-connector (npm) | 4.7.0 to before 4.7.3 | 4.7.3 | Patch available | GHSA-fvcj-hvfw-7f2v |
| — | botframework-connector (npm) | 4.8.0 to before 4.8.1 | 4.8.1 | Patch available | GHSA-fvcj-hvfw-7f2v |
| — | botframework-connector (npm) | 4.9.0 to before 4.9.4 | 4.9.4 | Patch available | GHSA-fvcj-hvfw-7f2v |
| — | botframework-connector (npm) | 4.10.0 to before 4.10.3 | 4.10.3 | Patch available | GHSA-fvcj-hvfw-7f2v |
- Bot Framework SDK for .NET Framework VendorMicrosoft Affected 4.0.0 to before publication Fixed in publication Patch available CNA
- Bot Framework SDK for JavaScript VendorMicrosoft Affected 4.0.0 to before publication Fixed in publication Patch available CNA
- Bot Framework SDK for Python VendorMicrosoft Affected 4.0.0 to before publication Fixed in publication Patch available CNA
- botframework-connector (npm) Vendor— Affected 4.7.0 to before 4.7.3 Fixed in 4.7.3 Patch available GHSA-fvcj-hvfw-7f2v
- botframework-connector (npm) Vendor— Affected 4.8.0 to before 4.8.1 Fixed in 4.8.1 Patch available GHSA-fvcj-hvfw-7f2v
- botframework-connector (npm) Vendor— Affected 4.9.0 to before 4.9.4 Fixed in 4.9.4 Patch available GHSA-fvcj-hvfw-7f2v
- botframework-connector (npm) Vendor— Affected 4.10.0 to before 4.10.3 Fixed in 4.10.3 Patch available GHSA-fvcj-hvfw-7f2v
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:bot_framework_software_development_kit:-:*:*:*:*:.net_framework:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:bot_framework_software_development_kit:-:*:*:*:*:javascript:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:bot_framework_software_development_kit:-:*:*:*:*:python:*:* | not specified by NVD | Vulnerable | Microsoft |
- cpe:2.3:a:microsoft:bot_framework_software_development_kit:-:*:*:*:*:.net_framework:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:bot_framework_software_development_kit:-:*:*:*:*:javascript:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:bot_framework_software_development_kit:-:*:*:*:*:python:*:* Versions not specified by NVD Vulnerable ·Microsoft
Remediation
- Fix · CNA Bot Framework SDK for .NET Framework (Microsoft) Fixed in publication
- Fix · CNA Bot Framework SDK for JavaScript (Microsoft) Fixed in publication
- Fix · CNA Bot Framework SDK for Python (Microsoft) Fixed in publication
- Fix · GHSA-fvcj-hvfw-7f2v botframework-connector (npm) Fixed in 4.7.3 Advisory →
- Fix · GHSA-fvcj-hvfw-7f2v botframework-connector (npm) Fixed in 4.8.1 Advisory →
- Fix · GHSA-fvcj-hvfw-7f2v botframework-connector (npm) Fixed in 4.9.4 Advisory →
- Fix · GHSA-fvcj-hvfw-7f2v botframework-connector (npm) Fixed in 4.10.3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-1725
- 2026-10-03 Alias added: GHSA-fvcj-hvfw-7f2v
References
Advisory 2
Other 5
- https://github.com/microsoft/botbuilder-js/security/advisories/GHSA-fvcj-hvfw-7f2v
- https://aka.ms/SkillClaimsValidationJavascript
- https://github.com/microsoft/botbuilder-js
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1725
- https://www.npmjs.com/package/botframework-connector
More Microsoft Bot Framework Software Development Kit vulnerabilities
- TI-2021-19233 Bot Framework SDK Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.8
Sources
- CVE-2021-1725 · CVE Program
- CVE-2021-1725 · NVD
- FIRST EPSS
- GHSA-fvcj-hvfw-7f2v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences