JDA (Java Discord API) downloads external URLs when updating message components

published 2025-12-09 11mo ago modified 2025-12-09 11mo ago

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

### Impact

Anyone using untrusted message components may be affected. On versions >=6.0.0,<6.1.3 of JDA, the requester will attempt to download external media URLs from components if they are used in an update or send request.

If you are used `Message#getComponents` or similar to get a list of components and then send those components with `sendMessageComponents` or other methods, you might unintentionally download media from an external URL in the resolved media of a `Thumbnail`, `FileDisplay`, or `MediaGallery`.

### Patches

This bug has been fixed in 6.1.3, and we recommend updating.

### Workarounds

Avoid sending components from untrusted messages or update to version 6.1.3.

Patch / fix

fixed in 1 links 1

maven net.dv8tion:JDA 6.1.3

github.com/discord-jda/JDA@bb6d2ce commit

Is GHSA-93fv-4pm9-xp28 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
maven	net.dv8tion:JDA	>=6.0.0, <6.1.3	6.1.3

Classification

Weakness

CWE-918 Server-Side Request Forgery

References

Sources

GitHub Advisory GHSA-93fv-4pm9-xp28

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.