Read the docs
TI-2021-04529 Aliases CVE-2021-21431GHSA-23c7-6444-399m

Improper Input Validation in sopel-plugins.channelmgnt

Priority LOW 37CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-284.

Summary

sopel-channelmgnt is a channelmgnt plugin for sopel. In versions prior to 2.0.1, on some IRC servers, restrictions around the removal of the bot using the kick/kickban command could be bypassed when kicking multiple users at once. We also believe it may have been possible to remove users from other channels but due to the wonder that is IRC and following RfCs, We have no POC for that. Freenode is not affected. This is fixed in version 2.0.1. As a workaround, do not use this plugin on networks where TARGMAX > 1.

Why it matters now

EPSS 0.01081 65th percentileScored 2026-11-07
Fix Fixed sopel-channelmgnt (MirahezeBots): 2.0.1sopel-plugins.channelmgnt (PyPI): 2.0.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MirahezeBotssopel-channelmgntbefore 2.0.12.0.1Patch availableCNA
—sopel-plugins.channelmgnt (PyPI)before 2.0.12.0.1Patch availableGHSA-23c7-6444-399m
  • sopel-channelmgnt VendorMirahezeBots Affected before 2.0.1 Fixed in 2.0.1 Patch available CNA
  • sopel-plugins.channelmgnt (PyPI) Vendor— Affected before 2.0.1 Fixed in 2.0.1 Patch available GHSA-23c7-6444-399m

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mirahezebots:channelmgnt:*:*:*:*:*:sopel:*:*before 2.0.1VulnerableMirahezeBots
  • cpe:2.3:a:mirahezebots:channelmgnt:*:*:*:*:*:sopel:*:* Versions before 2.0.1 Vulnerable ·MirahezeBots

Remediation

  • Fix · CNA sopel-channelmgnt (MirahezeBots) Fixed in 2.0.1
  • Fix · GHSA-23c7-6444-399m sopel-plugins.channelmgnt (PyPI) Fixed in 2.0.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-21431
  2. 2026-10-03 Alias added: GHSA-23c7-6444-399m

References

Patch 1

Advisory 3

Other 4

  • TI-2020-12023 Privilege Escalation in Channelmgnt plug-in for Sopel CVSS 3.1HIGH 7.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences