Read the docs
TI-2022-08661 Aliases CVE-2022-24849GHSA-frxg-hf44-q765

Contact to DisCatSharp-owned server using authenticated client

Priority LOW 31CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

DisCatSharp is a Discord API wrapper for .NET. Users of versions 9.8.5, 9.8.6, 9.9.0 and previously published prereleases of 10.0.0 who have used either one of the two `RequireDisCatSharpDeveloperAttribute`s or the `BaseDiscordClient.LibraryDeveloperTeam` have potentially had their bot token sent to a web server not affiliated with Discord. This server is owned and operated by DisCatSharp's development team. The tokens were not logged, yet it is still advisable to reset the tokens of potentially affected bots. 9.9.1 has been released to patch the issue for the current stable release and the current 10.0.0 prereleases are also no longer affected. Users unable to upgrade should remove all uses of the two `RequireDisCatSharpDeveloperAttribute`s and all direct calls to `BaseDiscordClient.LibraryDeveloperTeam`.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0088 59th percentileScored 2026-11-07
Fix Fixed DisCatSharp (Aiko-IT-Systems): 9.9.1DisCatSharp (NuGet): 9.9.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Aiko-IT-SystemsDisCatSharp9.8.5 to before 9.9.19.9.1Patch availableCNA
—DisCatSharp (NuGet)9.8.5 to before 9.9.19.9.1Patch availableGHSA-frxg-hf44-q765
  • DisCatSharp VendorAiko-IT-Systems Affected 9.8.5 to before 9.9.1 Fixed in 9.9.1 Patch available CNA
  • DisCatSharp (NuGet) Vendor— Affected 9.8.5 to before 9.9.1 Fixed in 9.9.1 Patch available GHSA-frxg-hf44-q765

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:aitsys:discatsharp:*:*:*:*:*:*:*:*9.8.5 to before 9.9.1VulnerableAitsys
  • cpe:2.3:a:aitsys:discatsharp:*:*:*:*:*:*:*:* Versions 9.8.5 to before 9.9.1 Vulnerable ·Aitsys

Remediation

  • Fix · CNA DisCatSharp (Aiko-IT-Systems) Fixed in 9.9.1
  • Fix · GHSA-frxg-hf44-q765 DisCatSharp (NuGet) Fixed in 9.9.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-24849
  2. 2026-10-03 Alias added: GHSA-frxg-hf44-q765

References

Advisory 2

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences