VYPR
← All advisories
High severity7.2NVD Advisory· Published May 17, 2025· Updated Apr 15, 2026

CVE-2025-47948

CVE-2025-47948

Description

Cocotais Bot is a QQ official robot framework based on qq-bot-sdk. Starting in version 1.5.0-test2-hotfix and prior to version 1.6.2, command echoing feature in the framework allows users to indirectly trigger privileged behavior by injecting special platform tags. Specifically, an unauthorized user can use the /echo <qqbot-at-everyone /> command to cause the bot to send a message that mentions all members in the chat, bypassing any permission controls. This can lead to spam, disruption, or abuse of notification systems. Version 1.6.2 contains a patch for the issue.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
cocotais-botnpm
>= 1.5.0-test2-hotfix, < 1.6.21.6.2

Patches

2
155baf9fbe44
https://github.com/cocotais/cocotais-botvia osv
d1cf01a9a41b

Merge commit from fork

https://github.com/cocotais/cocotais-bot刘宇轩 (刘lyxAndy)May 17, 2025via ghsa
commit
1 file changed · +0 −11
  • src/builtins.ts+0 −11 modified
    @@ -1,7 +1,6 @@
 import { globalStage } from ".";
 import { havePermission } from "./bot";
 import { CocotaisBotPlugin } from "./plugin";
-import { C2cMessageEvent, GroupMessageEvent, GuildMessageEvent } from "./types";
 
 export function getBuiltinPlugins(){
     return [
@@ -25,16 +24,6 @@ export function getBuiltinPlugins(){
                 })
             })
             return plugin
-        }(),
-        function(){
-            const plugin = new CocotaisBotPlugin("builtin:echo","1.0.0")
-            plugin.onMounted((bot) => {
-                plugin.command.register("/echo","重复你说的话", (type, _msgs, event) => {
-                    let content = _msgs.join(" ")
-                    event.reply(content)
-                })
-            })
-            return plugin
         }()
     ]
 }
\ No newline at end of file

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.