CVE-2025-62378

CommandKit is the discord.js meta-framework for building Discord bots. In versions 1.2.0-rc.1 through 1.2.0-rc.11, a logic flaw exists in the message command handler that affects how the commandName property is exposed to both middleware functions and command execution contexts when handling command aliases. When a message command is invoked using an alias, the ctx.commandName value reflects the alias rather than the canonical command name. This occurs in both middleware functions and within the command's own run function. Although not explicitly documented, CommandKit's examples and guidance around middleware usage implicitly convey that ctx.commandName represents the canonical command identifier. Middleware examples in the documentation consistently use ctx.commandName to reference the command being executed. Developers who assume ctx.commandName is canonical may introduce unintended behavior when relying on it for logic such as permission checks, rate limiting, or audit logging. This could allow unauthorized command execution or inaccurate access control decisions. Slash commands and context menu commands are not affected. This issue has been patched in version 1.2.0-rc.12, where ctx.commandName now consistently returns the actual canonical command name regardless of the alias used to invoke it.

• CWE-706

• https://github.com/underctrl-io/commandkit/security/advisories/GHSA-fhwm-pc6r-4h2f

Published

Oct 15, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-62371OpenSearch Data Prepper as an open source data collector for…7.4
• CVE-2025-62372vLLM is an inference and serving engine for large language m…6.5
• CVE-2025-62373Pipecat is an open-source Python framework for building real…9.8
• CVE-2025-62374Parse Javascript SDK provides access to the powerful Parse S…6.4
• CVE-2025-62375go-witness and witness are Go modules for generating attesta…6.9
• CVE-2025-62376pwn.college DOJO is an education platform for learning cyber…9.5
• CVE-2025-62379Reflex is a library to build full-stack web apps in pure Pyt…3.1
• CVE-2025-6238The AI Engine plugin for WordPress is vulnerable to open red…8
• CVE-2025-62380mailgen is a Node.js package that generates responsive HTML …2.9
• CVE-2025-62381sveltekit-superforms makes SvelteKit forms a pleasure to use…8.3
• CVE-2025-62382Frigate is a network video recorder (NVR) with realtime loca…7.7
• CVE-2025-62383SQL injection in Ivanti Endpoint Manager before version 2024…6.5