Read the docs
TI-2021-10174 Aliases CVE-2021-29461

LFI and possible code execution on discord-recon using tools arguments

Priority MEDIUM 43CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-94.

Summary

Discord Recon Server is a bot that allows one to do one's reconnaissance process from one's Discord. A vulnerability in Discord Recon Server prior to 0.0.3 could be exploited to read internal files from the system and write files into the system resulting in remote code execution. This issue has been fixed in version 0.0.3. As a workaround, one may copy the code from `assets/CommandInjection.py` in the Discord Recon Server code repository and overwrite vulnerable code from one's own Discord Recon Server implementation with code that contains the patch.

Why it matters now

EPSS 0.02476 84th percentileScored 2026-11-07
Fix Fixed Discord-Recon (DEMON1A): 0.0.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
DEMON1ADiscord-Reconbefore 0.0.30.0.3Patch availableCNA
  • Discord-Recon VendorDEMON1A Affected before 0.0.3 Fixed in 0.0.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:demon1a:discord-recon:0.0.2:*:*:*:*:*:*:*0.0.2VulnerableDEMON1A
  • cpe:2.3:a:demon1a:discord-recon:0.0.2:*:*:*:*:*:*:* Versions 0.0.2 Vulnerable ·DEMON1A

Remediation

  • Fix · CNA Discord-Recon (DEMON1A) Fixed in 0.0.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-29461

References

Advisory 1

  • TI-2024-14384 Remote code execution on ReconServer due to improper input sanitization on the prips command CVSS 3.1CRITICAL 10.0
  • TI-2021-04531 Remote code execution on discord-recon .dirsearch and .arjun commands due to improper input validation CVSS 3.1CRITICAL 9.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences