VYPR
← All advisories
High severityNVD Advisory· Published Aug 18, 2022· Updated Apr 23, 2025

Bots using py-cord as discord api wrapper are vulnerable to shutdowns through remote code execution

CVE-2022-36024

Description

py-cord 2.0.0 bots are vulnerable to remote shutdown when added to a server with only the application.commands scope, patched in 2.0.1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

py-cord 2.0.0 bots are vulnerable to remote shutdown when added to a server with only the `application.commands` scope, patched in 2.0.1.

Overview

CVE-2022-36024 is a vulnerability in py-cord version 2.0.0, a Python API wrapper for Discord. The issue allows a remote attacker to shut down a bot if the bot is added to a Discord server with the application.commands scope but without the bot scope [1][4]. This affects all public bots using slash commands as of the disclosure date [1][4].

Exploitation

Exploitation occurs when a malicious user adds a vulnerable bot to a server using the application.commands scope alone. Once the bot is in this server, the attacker can execute commands that cause the bot to shut down remotely [4]. No additional authentication is needed beyond the ability to create or manage server integrations.

Impact

An attacker can force the bot to shut down, resulting in denial of service for the bot's functionality across all servers where it is deployed. This disrupts any services relying on the bot's commands or interactions [1][4].

Mitigation

The vulnerability is fixed in py-cord version 2.0.1 [1][4]. No workarounds are available; users must upgrade to the patched version [1].

References
  1. NVD - CVE-2022-36024
  2. Unwanted Remote Shutdown Vulnerability

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
py-cordPyPI
>= 2.0.0, < 2.0.12.0.1

Affected products

2
  • ghsa-coords
    pkg:pypi/py-cord
    Range: >= 2.0.0, < 2.0.1
  • Pycord-Development/pycordv5
    Range: = 2.0.0

Patches

1
2c3f794318aa

Merge pull request #1568 from NeloBlivion/patch-11

https://github.com/Pycord-Development/pycordBobDotComAug 16, 2022via ghsa-ref
commitPR #1568
1 file changed · +6 −3
  • discord/interactions.py+6 −3 modified
    @@ -178,15 +178,18 @@ def _from_data(self, data: InteractionPayload):
 
         # TODO: there's a potential data loss here
         if self.guild_id:
-            guild = self.guild or Object(id=self.guild_id)
+            guild = self.guild or self._state._get_guild(self.guild_id) or Object(id=self.guild_id)
             try:
                 member = data["member"]  # type: ignore
             except KeyError:
                 pass
             else:
-                cache_flag = self._state.member_cache_flags.interaction
-                self.user = guild._get_and_update_member(member, int(member["user"]["id"]), cache_flag)
                 self._permissions = int(member.get("permissions", 0))
+                if not isinstance(guild, Object):
+                    cache_flag = self._state.member_cache_flags.interaction
+                    self.user = guild._get_and_update_member(member, int(member["user"]["id"]), cache_flag)
+                else:
+                    self.user = Member(state=self._state, data=member, guild=guild)
         else:
             try:
                 self.user = User(state=self._state, data=data["user"])

Vulnerability mechanics

Root cause

"Missing type check before calling guild._get_and_update_member() on a bare Object instance causes AttributeError crash."

Attack vector

An attacker adds the vulnerable bot to a Discord server using only the `application.commands` OAuth2 scope, omitting the `bot` scope. When the bot receives an interaction (e.g., a slash command) in that guild, the `_from_data` method attempts to call `guild._get_and_update_member()` on a guild object that is a plain `Object` rather than a full `Guild` instance. This raises an unhandled `AttributeError`, crashing the bot process remotely.

Affected code

The vulnerability resides in `discord/interactions.py` in the `_from_data` method. When a bot is added with only the `application.commands` scope (no `bot` scope), the `guild` object may be a bare `Object` instance that lacks the `_get_and_update_member` method, causing an `AttributeError` that crashes the bot.

What the fix does

The patch adds a guard `if not isinstance(guild, Object):` before calling `guild._get_and_update_member()`. When the guild is a bare `Object` (which happens when the bot lacks the `bot` scope and therefore has no cached guild data), the code now falls through to create a `Member` directly from the interaction data using `Member(state=self._state, data=member, guild=guild)`. This prevents the `AttributeError` that previously crashed the bot. Additionally, the patch changes the fallback guild lookup from `self.guild or Object(...)` to `self.guild or self._state._get_guild(self.guild_id) or Object(...)`, giving the state a chance to return a real `Guild` object before falling back to `Object`.

Preconditions

  • configThe bot must be invited to a Discord server using only the `application.commands` OAuth2 scope, without the `bot` scope.
  • inputThe attacker must be able to trigger an interaction (e.g., a slash command) in that guild.

Generated on May 23, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.