GHSA-93fv-4pm9-xp28

Source

https://github.com/advisories/GHSA-93fv-4pm9-xp28

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-93fv-4pm9-xp28/GHSA-93fv-4pm9-xp28.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-93fv-4pm9-xp28

Published

2025-12-09T17:23:54Z

Modified

2025-12-09T17:36:14Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N CVSS Calculator

Summary

JDA (Java Discord API) downloads external URLs when updating message components

Details

Impact

Anyone using untrusted message components may be affected. On versions >=6.0.0,<6.1.3 of JDA, the requester will attempt to download external media URLs from components if they are used in an update or send request.

If you are used Message#getComponents or similar to get a list of components and then send those components with sendMessageComponents or other methods, you might unintentionally download media from an external URL in the resolved media of a Thumbnail, FileDisplay, or MediaGallery.

Patches

This bug has been fixed in 6.1.3, and we recommend updating.

Workarounds

Avoid sending components from untrusted messages or update to version 6.1.3.

Database specific

{
    "cwe_ids": [
        "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-12-09T17:23:54Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
}

References

Affected packages

Maven / net.dv8tion:JDA

Package

Name: net.dv8tion:JDA; View open source insights on deps.dev
Purl: pkg:maven/net.dv8tion/JDA

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.0.0

Fixed

6.1.3

Affected versions

6.*

6.0.0

6.0.0-preview

6.0.0-preview_DEV

6.1.0

6.1.1

6.1.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-93fv-4pm9-xp28/GHSA-93fv-4pm9-xp28.json"