CVE-2024-43404

Remote Code Execution Vulnerability in MEGABOT

9.8 Critical

MEGABOT is a fully customized Discord bot for learning and fun. The /math command and functionality of MEGABOT versions < 1.5.0 contains a remote code execution vulnerability due to a Python eval(). The vulnerability allows an attacker to inject Python code into the expression parameter when using /math in any Discord channel. This vulnerability impacts any discord guild utilizing MEGABOT. This vulnerability was fixed in release version 1.5.0.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.11%Up 1.1 points since Aug 21, 2024

What each source reports

CVE List Score used 9.8

Remote Code Execution Vulnerability in MEGABOT

Record: CVE-2024-43404
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-95
Updated: 2026-11-02

EUVDEUVD-2024-40269 9.8

Record: EUVD-2024-40269
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-03

NVD 9.8

Record: CVE-2024-43404
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-95, CWE-94
Updated: 2026-11-02

OSV 9.8

Remote Code Execution Vulnerability in MEGABOT

Record: CVE-2024-43404
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-95
Updated: 2026-11-02

Affected products

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-43404 is a critical vulnerability (CVSS 9.8) in Megacord Megabot, published August 20, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.11%, the 66th percentile. No source names a fixed version.