CVE-2021-29501: Improper Neutralization of Special Elements used in a Command ('Command Injection') (CWE-77)
value: Ticketer is a command based ticket system cog (plugin) for the red discord bot. A vulnerability allowing discord users to expose sensitive information has been found in the Ticketer cog. Please upgrade to version 1.0.1 as soon as possible. As a workaround users may unload the ticketer cog to disable the exploitable code.
CWE description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CVSS v3 base score: 6.5
Published: 2021-05-10T17:15Z
Repository: https://github.com/Dav-Git/Dav-Cogs
Language: Python
Files changed: ticketer/ticketer.py
Commit date: 2021-05-09 10:53:53 +0000
Commit message: Merge pull request from GHSA-r2cf-49r7-pfj7

* fix issue with vaiables

* upgrade version
Diff: diff --git a/ticketer/ticketer.py b/ticketer/ticketer.py
index f6463c5..d0b7d50 100644
--- a/ticketer/ticketer.py
+++ b/ticketer/ticketer.py
@@ -4,18 +4,19 @@ from datetime import datetime
 from redbot.core import commands, checks, Config, modlog
 
 
 class Ticketer(commands.Cog):
     """Ticketer"""
-    __version__="1.0.0"
+
+    __version__ = "1.0.1"
 
     async def red_delete_data_for_user(self, *, requester, user_id):
         # This cog stores no EUD
         return
 
     def format_help_for_context(self, ctx: commands.Context) -> str:
-        #Thanks Sinbad! And Trusty in whose cogs I found this.
+        # Thanks Sinbad! And Trusty in whose cogs I found this.
         pre_processed = super().format_help_for_context(ctx)
         return f"{pre_processed}\n\nVersion: {self.__version__}"
 
     def __init__(self):
         self.config = Config.get_conf(self, 200730042020, force_registration=True)
@@ -81,11 +82,11 @@ class Ticketer(commands.Cog):
 
     @ticketer.command()
     async def message(self, ctx, *, message: str):
         """Set the message that is shown at the start of each ticket channel.\n\nUse ``{user.mention}`` to mention the person who created the ticket."""
         try:
-            message.format(user=ctx.author)
+            message.format(user=SafeMember(ctx.author))
             await self.config.guild(ctx.guild).message.set(message)
             await ctx.send(f"The message has been set to `{message}`.")
         except KeyError:
             await ctx.send(
                 "Setting the message failed. Please make sure to only use supported variables in  `\{\}`"
@@ -242,11 +243,11 @@ class Ticketer(commands.Cog):
                     name,
                     overwrites=overwrite,
                     category=ctx.guild.get_channel(settings["open_category"]),
                     topic=reason,
                 )
-                await ticketchannel.send(settings["message"].format(user=ctx.author))
+                await ticketchannel.send(settings["message"].format(user=SafeMember(ctx.author)))
                 embed = discord.Embed(
                     title=name,
                     description=reason,
                     timestamp=datetime.utcnow(),
                 ).set_footer(text="Last updated at:")
@@ -366,5 +367,19 @@ class Ticketer(commands.Cog):
             await ctx.send("Ticket manager role not set up yet.")
         if count == 4:
             return True
         else:
             return False
+
+
+class SafeMember:
+    """Thank you kenny https://github.com/kennnyshiwa/kennnyshiwa-cogs"""
+
+    def __init__(self, member: discord.Member):
+        self.name = member.name
+        self.mention = member.mention
+
+    def __str__(self):
+        return self.name
+
+    def __getattr__(self, name):
+        return ""
\ No newline at end of file

Vulnerable code:     __version__="1.0.0"
        #Thanks Sinbad! And Trusty in whose cogs I found this.
            message.format(user=ctx.author)
                await ticketchannel.send(settings["message"].format(user=ctx.author))
Fixed code: 
    __version__ = "1.0.1"
        # Thanks Sinbad! And Trusty in whose cogs I found this.
            message.format(user=SafeMember(ctx.author))
                await ticketchannel.send(settings["message"].format(user=SafeMember(ctx.author)))


class SafeMember:
    """Thank you kenny https://github.com/kennnyshiwa/kennnyshiwa-cogs"""

    def __init__(self, member: discord.Member):
        self.name = member.name
        self.mention = member.mention

    def __str__(self):
        return self.name

    def __getattr__(self, name):
        return ""