What’s Vulnerable › Vulnerabilities

CVE-2020-15172: Remote Code Execution in Act module

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-09-15 · updated 2026-06-17
• Weakness: CWE-502

Description

The Act module for Red Discord Bot before commit 6b9f3b86 is vulnerable to Remote Code Execution. With this exploit, Discord users can use specially crafted messages to perform destructive actions and/or access sensitive information. Unloading the Act module with `unload act` can render this exploit inaccessible.

Affected products

• zephyrkul FluffyCogs: before 2.0.38 — fixed in 2.0.38

How to fix

Upgrade to a fixed version: zephyrkul FluffyCogs 2.0.38. Check the vendor advisory for mitigations.

References

• https://github.com/zephyrkul/FluffyCogs/commit/6b9f3b862e1f0a5429c62f3090f814e53a242347
• https://github.com/zephyrkul/FluffyCogs/security/advisories/GHSA-rm7m-j4xp-rv2p
• https://github.com/zephyrkul/FluffyCogs/commit/6b9f3b862e1f0a5429c62f3090f814e53a242347
• https://github.com/zephyrkul/FluffyCogs/security/advisories/GHSA-rm7m-j4xp-rv2p

Get alerted when CVE-2020-15172 or the next vulnerability affects your stack