CVE-2021-29465: Remote file overwrite on discord-recon can result in DoS and Remote Code Execution

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-04-22 · updated 2026-06-17
Weakness: CWE-94

Description

Discord-Recon is a bot for the Discord chat service. Versions of Discord-Recon 0.0.3 and prior contain a vulnerability in which a remote attacker is able to overwrite any file on the system with the command results. This can result in remote code execution when the user overwrite important files on the system. As a workaround, bot maintainers can edit their `setting.py` file then add `<` and `>` into the `RCE` variable inside of it to fix the issue without an update. The vulnerability is patched in version 0.0.4.

Affected products

Discord-Recon: before 0.0.4 — fixed in 0.0.4

How to fix

Upgrade to a fixed version: Discord-Recon 0.0.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-29465 or the next vulnerability affects your stack