CVE-2025-26604
Published: 18 February 2025
Summary
CVE-2025-26604 is a high-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability. Its CVSS base score is 8.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Python (T1059.006); ranked at the 29.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-11 (User-installed Software) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the vulnerability by requiring timely remediation through upgrading to the fixed commit f0d9e70841a0e3170b88c4f8d562018ccd8e8b14 as advised.
Prohibits or restricts installation of user-submitted modules containing arbitrary code, preventing exploitation via malicious extensions.
Deploys malicious code protection to scan and block execution of harmful user-submitted code in the bot framework.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables arbitrary Python code execution via malicious module loading to extract sensitive information such as the bot token.
NVD Description
Discord-Bot-Framework-Kernel is a Discord bot framework built with interactions.py, featuring modular extension management and secure execution. Because of the nature of arbitrary user-submited code execution, this allows user to execute potentially malicious code to perform damage or extract sensitive information.…
more
By loading the module containing the following code and run the command, the bot token can be extracted. Then the attacker can load a blocking module to sabotage the bot (DDoS attack) and the token can be used to make the fake bot act as the real one. If the bot has very high privilege, the attacker basically has full control before the user kicks the bot. Any Discord user that hosts Discord-Bot-Framework-Kernel before commit f0d9e70841a0e3170b88c4f8d562018ccd8e8b14 is affected. Users are advised to upgrade. Users unable to upgrade may attempt to limit their discord bot's access via configuration options.
Deeper analysisAI
CVE-2025-26604 is a vulnerability in Discord-Bot-Framework-Kernel, a Discord bot framework built with interactions.py that supports modular extension management and secure execution. The issue stems from the framework's support for arbitrary user-submitted code execution, enabling the execution of potentially malicious code that can cause damage or extract sensitive information, such as the bot token. It affects any Discord user hosting Discord-Bot-Framework-Kernel prior to commit f0d9e70841a0e3170b88c4f8d562018ccd8e8b14. The vulnerability is rated 8.3 (High) under CVSS 3.1 (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:H) and is associated with CWE-200 (Exposure of Sensitive Information).
Attackers with high privileges can exploit this by loading a malicious module and executing a command to extract the bot token. With the token, they can deploy a blocking module to sabotage the bot via a DDoS-style attack, while using the stolen token to operate a fake bot that impersonates the legitimate one. If the bot holds high privileges on the Discord server, attackers gain effectively full control until the bot is kicked.
Advisories recommend upgrading to commit f0d9e70841a0e3170b88c4f8d562018ccd8e8b14 or later. For those unable to upgrade, limiting the Discord bot's access through configuration options may reduce risk. Relevant details are available in the GitHub commit and security advisory.
Details
- CWE(s)