npm package
cocotais-bot
pkg:npm/cocotais-bot
Vulnerabilities (1)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2025-47948 | Hig | 7.2 | >= 1.5.0-test2-hotfix, < 1.6.2 | 1.6.2 | May 17, 2025 | Cocotais Bot is a QQ official robot framework based on qq-bot-sdk. Starting in version 1.5.0-test2-hotfix and prior to version 1.6.2, command echoing feature in the framework allows users to indirectly trigger privileged behavior by injecting special platform tags. Specifically, |
- affected >= 1.5.0-test2-hotfix, < 1.6.2fixed 1.6.2
Cocotais Bot is a QQ official robot framework based on qq-bot-sdk. Starting in version 1.5.0-test2-hotfix and prior to version 1.6.2, command echoing feature in the framework allows users to indirectly trigger privileged behavior by injecting special platform tags. Specifically,