underctrl-io commandkit up to 1.2.0-rc.11 commandName name resolution

Summaryinfo

A vulnerability was found in underctrl-io commandkit up to 1.2.0-rc.11. It has been rated as problematic. Affected by this vulnerability is an unknown functionality. Performing a manipulation of the argument commandName results in name resolution. This vulnerability was named CVE-2025-62378. The attack needs to be approached locally. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in underctrl-io commandkit up to 1.2.0-rc.11. It has been classified as problematic. This affects an unknown function. The manipulation of the argument commandName with an unknown input leads to a name resolution vulnerability. CWE is classifying the issue as CWE-706. The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

CommandKit is the discord.js meta-framework for building Discord bots. In versions 1.2.0-rc.1 through 1.2.0-rc.11, a logic flaw exists in the message command handler that affects how the commandName property is exposed to both middleware functions and command execution contexts when handling command aliases. When a message command is invoked using an alias, the ctx.commandName value reflects the alias rather than the canonical command name. This occurs in both middleware functions and within the command's own run function. Although not explicitly documented, CommandKit's examples and guidance around middleware usage implicitly convey that ctx.commandName represents the canonical command identifier. Middleware examples in the documentation consistently use ctx.commandName to reference the command being executed. Developers who assume ctx.commandName is canonical may introduce unintended behavior when relying on it for logic such as permission checks, rate limiting, or audit logging. This could allow unauthorized command execution or inaccurate access control decisions. Slash commands and context menu commands are not affected. This issue has been patched in version 1.2.0-rc.12, where ctx.commandName now consistently returns the actual canonical command name regardless of the alias used to invoke it.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2025-62378 since 10/10/2025. The exploitability is told to be easy. An attack has to be approached locally. Technical details are known, but no exploit is available.

Upgrading to version 1.2.0-rc.12 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• underctrl-io

Name

• commandkit

Version

• 1.2.0-rc.0
• 1.2.0-rc.1
• 1.2.0-rc.2
• 1.2.0-rc.3
• 1.2.0-rc.4
• 1.2.0-rc.5
• 1.2.0-rc.6
• 1.2.0-rc.7
• 1.2.0-rc.8
• 1.2.0-rc.9
• 1.2.0-rc.10
• 1.2.0-rc.11

Website

• Product: https://github.com/underctrl-io/commandkit/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion