CVE-2024-43404

MEGABOT is a fully customized Discord bot for learning and fun. The `/math` command and functionality of MEGABOT versions < 1.5.0 contains a remote code execution vulnerability due to a Python `eval()`. The vulnerability allows an attacker to inject Python code into the `expression` parameter when using `/math` in any Discord channel. This vulnerability impacts any discord guild utilizing MEGABOT. This vulnerability was fixed in release version 1.5.0.

• CWE-95
• CWE-94

• https://github.com/NicPWNs/MEGABOT/commit/71e79e5581ea36313700385b112d863053fb7ed6Patch
• https://github.com/NicPWNs/MEGABOT/issues/137Issue Tracking
• https://github.com/NicPWNs/MEGABOT/pull/138Issue Tracking, Patch
• https://github.com/NicPWNs/MEGABOT/releases/tag/v1.5.0Release Notes
• https://github.com/NicPWNs/MEGABOT/security/advisories/GHSA-vhxp-4hwq-w3p2Patch, Vendor Advisory

Published

Aug 20, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-43399Mobile Security Framework (MobSF) is a pen-testing, malware …9.8
• CVE-2024-4340Passing a heavily nested list to sqlparse.parse() leads to a…7.5
• CVE-2024-43400XWiki Platform is a generic wiki platform offering runtime s…5.4
• CVE-2024-43401XWiki Platform is a generic wiki platform offering runtime s…8
• CVE-2024-43402Rust is a programming language. The fix for CVE-2024-24576, …8.8
• CVE-2024-43403Kanister is a data protection workflow management tool. The …8.8
• CVE-2024-43405Nuclei is a vulnerability scanner powered by YAML based temp…7.8
• CVE-2024-43406LF Edge eKuiper is a lightweight IoT data analytics and stre…8.8
• CVE-2024-43407CKEditor4 is an open source what-you-see-is-what-you-get HTM…6.1
• CVE-2024-43408Discourse Placeholder Forms will let you build dynamic docum…6.3
• CVE-2024-43409Ghost is a Node.js content management system. Improper authe…6.5
• CVE-2024-4341Authorization Bypass Through User-Controlled Key, Missing Au…6.5