tsutils (>=4.0.5 <=5.2.0) potentially affected by CVE-2020-15140 via red-discordbot (=3.0.2)

red-discordbot PYPI version =3.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on red-discordbot and may be impacted: - tsutils =4.0.5, =5.2.0 Source cves: CVE-2020-15140 Source advisory: OSV:PYSEC-2020-265...

CVE-2020-15140

CVE-2020-15140 affects Red Discord Bot prior to 3.3.11. A remote code execution in the Trivia module (leaderboard command) can be triggered by specially crafted usernames, enabling destructive actions or access to sensitive data. The issue is fixed in version 3.3.11. Remediation: upgrade to 3.3.1...

CVE-2020-15140 Remote Code Execution in Red Discord Bot

In Red Discord Bot before version 3.3.11, a RCE exploit has been discovered in the Trivia module: this exploit allows Discord users with specifically crafted usernames to inject code into the Trivia module's leaderboard command. By abusing this exploit, it's possible to perform destructive action...