What’s Vulnerable › Vulnerabilities

CVE-2025-65957: Core Bot is Leaking Sensitive Credentials in Logs, Errors, and Messages

• Severity: high (CVSS 8.8 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-11-26 · updated 2026-10-18
• Weakness: CWE-200

Description

Core Bot Is an Open Source discord bot made for maple hospital servers. Prior to commit dffe050, the API keys (SUPABASE_API_KEY, TOKEN) are loaded using environment variables, but there are cases in code (error handling, summaries, webhooks) where configuration summaries may inadvertently leak sensitive data (e.g., by failing to redact data in summary embeds or logs). This issue has been patched via commit dffe050.

Affected products

• Intercore-Productions Core-Bot: before dffe050d565a580edfcd0242efa45da88ab31260

References

• https://github.com/Intercore-Productions/Core-Bot/commit/dffe050d565a580edfcd0242efa45da88ab31260
• https://github.com/Intercore-Productions/Core-Bot/security/advisories/GHSA-42j6-x28v-38r8

Get alerted when CVE-2025-65957 or the next vulnerability affects your stack