Executive brief
CommandKit is a Discord bot command framework that handles message commands and their aliases. A flaw in its alias handling causes the context object passed to middleware and command handlers to expose the alias name instead of the canonical command name. Developers using this value for security checks like permission validation or rate limiting may make incorrect access control decisions, potentially allowing unauthorized command execution.
Technical details
CommandKit contains a logic flaw in its message command handler where the ctx.commandName property reflects the command alias used to invoke the command rather than the canonical command name. This affects both middleware functions and command execution contexts. The vulnerability exists because developers reasonably expect ctx.commandName to represent the canonical command identifier based on documentation examples and middleware best practices for "logging, authentication, permission checks, or other cross-cutting concerns." An attacker with local or application-level access can invoke a command using an alias, causing permission checks or audit logging to reference the wrong command name and potentially bypass access controls. Slash commands and context menu commands are unaffected. The vulnerability was patched in v1.2.0-rc.12 where ctx.commandName now correctly returns the canonical command name regardless of the alias used.
Affected products
- underctrl CommandKit >=1.2.0-rc.1, <=1.2.0-rc.11
Timeline
- 2025-10-13: disclosed: Advisory published
- 2025-10-13: patched: Fixed in v1.2.0-rc.12