Kennnyshiwa-cogs vulnerable to Remote Code Execution in Tickets Module
Priority MEDIUM 40CWE-94Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-94.
Summary
Kennnyshiwa-cogs contains cogs for Red Discordbot. An RCE exploit has been found in the Tickets module of kennnyshiwa-cogs. This exploit allows discord users to craft a message that can reveal sensitive and harmful information. Users can upgrade to version 5a84d60018468e5c0346f7ee74b2b4650a6dade7 to receive a patch or, as a workaround, unload tickets to render the exploit unusable.
Why it matters now
EPSS 0.00937 61st percentileScored 2026-11-07
Fix Fixed kennnyshiwa-cogs (kennnyshiwa): 5a84d60018468e5c0346f7ee74b2b4650a6dade7
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| kennnyshiwa | kennnyshiwa-cogs | before 5a84d60018468e5c0346f7ee74b2b4650a6dade7 | 5a84d60018468e5c0346f7ee74b2b4650a6dade7 | Patch available | CNA |
- kennnyshiwa-cogs Vendorkennnyshiwa Affected before 5a84d60018468e5c0346f7ee74b2b4650a6dade7 Fixed in 5a84d60018468e5c0346f7ee74b2b4650a6dade7 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:kennnyshiwa-cogs_project:kennnyshiwa-cogs:*:*:*:*:*:*:*:* | before 2021-05-05 | Vulnerable | Kennnyshiwa-cogs Project |
- cpe:2.3:a:kennnyshiwa-cogs_project:kennnyshiwa-cogs:*:*:*:*:*:*:*:* Versions before 2021-05-05 Vulnerable ·Kennnyshiwa-cogs Project
Remediation
- Fix · CNA kennnyshiwa-cogs (kennnyshiwa) Fixed in 5a84d60018468e5c0346f7ee74b2b4650a6dade7
Timeline
- 2026-10-02 Threatist record created from CVE-2021-29493
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences