CommandKit CVE-2025-62378

Exploitation requires all of the following: the target bot uses CommandKit message commands (slash commands and context menu commands are explicitly unaffected); the bot defines one or more command aliases; and the developer relies on ctx.commandName within middleware or the command's run function for security-sensitive logic such as permission checks, rate limiting, or audit logging - on a vulnerable build between 1.2.0-rc.1 and 1.2.0-rc.11. Limiting factors that reduce real-world risk: it is non-default/usage-dependent (bots that validate against ctx.command.data.command.name, enumerate all aliases, or avoid aliases are not exploitable), the attacker must be able to send message commands to the bot, and only pre-release RC versions are affected.

Signals point to a conditional, medium-severity issue rather than an urgent priority. The input CVSS base score is 6.1 (medium), driven by I:H (integrity) from potential authorization bypass. EPSS is very low at 0.16% (5th percentile), there is no CISA KEV listing, and no public exploit code is referenced - all consistent with a flaw that is not being broadly exploited. SSVC data was not provided in the input. A key signal conflict must be flagged: the supplied CVSS vector uses AV:L (local attack vector), yet the vulnerability is triggered by a Discord user sending a message command over the network to a bot, which is logically network-reachable - this looks like a mis-scored attack vector and should be verified; if AV is actually network, exploitability is higher than the local vector implies. Critically, exploitation is entirely contingent on a developer anti-pattern (relying on ctx.commandName for security logic while also defining command aliases), so the real-world attack surface is limited to specific, misconfigured bots rather than any default deployment. Net assessment: a legitimate authorization-logic bug worth patching for affected deployments, but low urgency at the ecosystem level given low EPSS, no known exploitation, pre-release (RC) affected versions, and the conditional trigger.

A low-privileged member of a Discord server targets a bot built on a vulnerable CommandKit RC that defines message-command aliases and enforces permission checks, rate limits, or audit logging in middleware based on ctx.commandName. The attacker invokes a restricted command using its alias; because ctx.commandName returns the alias instead of the canonical name, the middleware's permission check fails to match and the restricted command executes. No public exploit code was identified at time of analysis.