Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-0776 — Security research and proof-of-concept for CVE-2026-0776 affecting Discord Desktop Client. | Kitploit
Tools/GitHubGitHub/whenx/cve-2026-0776
Vulnerability ScannersCode AnalysisExploitationPapers & ResearchLearning & Education
GitHubwhenx/cve-2026-0776

CVE-2026-0776

Security research and proof-of-concept for CVE-2026-0776 affecting Discord Desktop Client.

View Repository
821 month agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-0776 - Discord Client Uncontrolled Search Path Element

Summary

This repository documents CVE-2026-0776, a local code execution issue affecting the Discord Desktop Client on Windows.

The vulnerability is related to unsafe module resolution behavior in Node.js-based components, which may allow JavaScript code to be loaded from unintended filesystem locations under specific conditions.

Details

  • CWE-427: Uncontrolled Search Path Element
  • CVSS: 7.3 (High)
  • Impact: Local Code Execution

Under certain circumstances, Discord may load JavaScript modules from untrusted locations. If an attacker is able to place a crafted module in a searched path, arbitrary JavaScript code may execute within the Discord process.

Impact

Successful exploitation may allow:

  • Execution of arbitrary JavaScript code
  • Execution with the privileges of the current user
  • Compromise of application runtime integrity

This is not a remote vulnerability and requires local access or specific environmental conditions.

Proof of Concept

The included PoC is safe and non-destructive. Its sole purpose is to demonstrate module loading behavior and confirm code execution.

No persistence mechanisms, credential access, system modification, or data exfiltration techniques are included.

Mitigation

  • Restrict write access to sensitive directories
  • Use application control policies (AppLocker / WDAC)
  • Monitor unexpected module loading activity
  • Keep Discord updated

Disclaimer

This repository is provided for educational and security research purposes only. The information contained herein should not be used for unauthorized activities. The author assumes no responsibility for misuse of this material.

Download Tool