{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2021-41250 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2021-41250 yet. Limit exposure of the affected software until one is available.","what":"CVE-2021-41250 is a medium-severity vulnerability in python-discord bot, published on 5 Nov 2021. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2021-41250 and fix it if it is affected.\n\nWhat it is: CVE-2021-41250 is a medium-severity vulnerability in python-discord bot, published on 5 Nov 2021. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2021-41250 in the wild and no public exploit code.\n\nAffected product: python-discord bot. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2021-41250/ (Markdown: https://insights.sbomify.com/CVE-2021-41250/index.md)","id":"CVE-2021-41250","markdown":"https://insights.sbomify.com/CVE-2021-41250/index.md","name":"CVE-2021-41250","record":{"aliases":["GHSA-j8c3-8x46-8pp6"],"analysis":{"component_type":"web_application","fix_type":"patch","impacts":["security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"Python Discord bot","requires_auth":"low_privilege","summary":"Attackers can bypass moderation filters by including a non-blacklisted URL in messages containing triggering tokens, allowing prohibited content to be posted.","user_interaction":"not_required","vuln_class":"security_feature_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"bot","vendor":"pythondiscord"}],"cvss":{"score":4.3,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"description":"Python discord bot is the community bot for the Python Discord community. In affected versions when a non-blacklisted URL and an otherwise triggering filter token is included in the same message the token filter does not trigger. This means that by including any non-blacklisted URL moderation filters can be bypassed. This issue has been resolved in commit 67390298852513d13e0213870e50fb3cff1424e0","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"Presence of non-blacklisted URL bypasses all other filters","id":"CVE-2021-41250","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"security_feature_bypass","year":"2021"},"n_packages":0,"n_references":2,"next":{"headline":"Possibility to elevate privileges or get unauthorized access to data","id":"CVE-2021-41251"},"packages":[],"prev":{"headline":"XSS vulnerability in GraphQL Playground","id":"CVE-2021-41249"},"products":["bot"],"published":"2021-11-05","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2024-08-04","vendors":["python-discord"]},"summary":"Attackers can bypass moderation filters by including a non-blacklisted URL in messages containing triggering tokens, allowing prohibited content to be posted.","url":"https://insights.sbomify.com/CVE-2021-41250/"}