PT-2025-21803 · Unknown · Cocotais Bot

Published 2025-05-17 · Updated 2025-05-19 · CVE-2025-47948

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions: Cocotais Bot versions 1.5.0-test2-hotfix through 1.6.2

Description: The issue allows unauthorized users to indirectly trigger privileged behavior by injecting special platform tags, potentially leading to spam, disruption, or abuse of notification systems. An unauthorized user can use the "/echo " command to cause the bot to send a message that mentions all members in the chat, bypassing any permission controls.

Recommendations: For versions 1.5.0-test2-hotfix through 1.6.2, update to version 1.6.2 to resolve the issue. As a temporary workaround, consider restricting access to the command echoing feature until the patch is applied. Avoid using the /echo command with special platform tags, such as <qqbot-at-everyone />, in the affected API endpoint until the issue is resolved.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2025-47948

GHSA-MJ2C-8HXF-FFVQ

Affected Products

Cocotais Bot

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47948.json · Exploit
• 🔥 https://github.com/cocotais/cocotais-bot/security/advisories/GHSA-mj2c-8hxf-ffvq · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-47948 · Security Note
• https://osv.dev/vulnerability/GHSA-mj2c-8hxf-ffvq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-47948 · Vendor Advisory
• https://github.com/cocotais/cocotais-bot/commit/d1cf01a9a41b3131241d1833444b890c8d6e70b8 · Note
• https://github.com/cocotais/cocotais-bot · Note
• https://t.me/latest_high_impact_cve/2397 · Telegram Post
• https://t.me/cvetracker/24110 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1923829445263065559 · Twitter Post