{"cve":"CVE-2020-26249","nvd":{"published":"2020-12-09T00:15:13.157","modified":"2026-06-17T03:07:55.067","status":"Modified","description":"Red Discord Bot Dashboard is an easy-to-use interactive web dashboard to control your Redbot. In Red Discord Bot before version 0.1.7a an RCE exploit has been discovered. This exploit allows Discord users with specially crafted Server names and Usernames/Nicknames to inject code into the webserver front-end code. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information. This high severity exploit has been fixed on version 0.1.7a. There are no workarounds, bot owners must upgrade their relevant packages (Dashboard module and Dashboard webserver) in order to patch this issue.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","score":8.7},"cwes":["CWE-79"],"references":["https://github.com/Cog-Creators/Red-Dashboard/commit/99d88b840674674166ce005b784ae8e31e955ab1","https://github.com/Cog-Creators/Red-Dashboard/commit/a6b9785338003ec87fb75305e7d1cc2d40c7ab91","https://github.com/Cog-Creators/Red-Dashboard/security/advisories/GHSA-hm45-mgqm-gjm4","https://pypi.org/project/Red-Dashboard","https://github.com/Cog-Creators/Red-Dashboard/commit/99d88b840674674166ce005b784ae8e31e955ab1"],"products":["cogboard:red-dashboard"],"source":"nvd","synced_at":"2026-10-19T21:12:09.559580076+00:00"},"epss":{"cve":"CVE-2020-26249","score":0.01303,"percentile":0.70501,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-hm45-mgqm-gjm4","url":"https://osv.dev/vulnerability/GHSA-hm45-mgqm-gjm4","summary":"Remote Code Execution (RCE) Exploit on Cross Site Scripting (XSS) Vulnerability","modified":"2026-07-08T05:59:35.567384290Z","packages":[{"ecosystem":"PyPI","name":"red-dashboard","purl":"pkg:pypi/red-dashboard","ranges":["<0.1.7a"],"fixed":["0.1.7a"]}]},{"id":"PYSEC-2020-98","url":"https://osv.dev/vulnerability/PYSEC-2020-98","summary":"","modified":"2023-11-08T04:03:16.188805Z","packages":[{"ecosystem":"PyPI","name":"red-dashboard","purl":"pkg:pypi/red-dashboard","ranges":["<0.1.7a"],"fixed":["0.1.7a"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}