Description
Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.4, several moderation commands echo user-controlled reason text in public bot replies without disabling mention parsing. A moderator who does not have permission to mention everyone can still make the bot send @everyone or @here if the bot has that permission. This issue has been patched in version 1.0.4.
Published: 2026-06-11
Score: 2.3 Low
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The bot echoes user‑controlled reason text in public moderation replies without disabling mention parsing, allowing an attacker to cause the bot to post @everyone or @here pings and flood the server. This flaw is a form of uncontrolled output of unencoded text (CWE‑116).

Affected Systems

Duck‑Organization Quest Bot versions prior to 1.0.4 are affected. The issue was fixed in v1.0.4, which suppresses mention parsing in moderation replies.

Risk and Exploitability

The CVSS score of 2.3 indicates low severity; EPSS data is not available and the vulnerability is not in the CISA KEV catalog. Exploitation requires that an attacker can invoke a moderation command and that the bot possesses @everyone or @here permissions. Under those conditions, the risk is limited to injection of large‑volume notification pings.

Generated by OpenCVE AI on June 11, 2026 at 22:24 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Quest Bot to version 1.0.4 or later
  • Revoke the bot’s @everyone and @here permissions or limit them to appropriate channels
  • Restrict moderator roles so that only trusted users can invoke moderation commands and adjust bot settings to strip or escape mention parsing in moderation replies

Generated by OpenCVE AI on June 11, 2026 at 22:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 11 Jun 2026 19:00:00 +0000

Type Values Removed Values Added
Description Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.4, several moderation commands echo user-controlled reason text in public bot replies without disabling mention parsing. A moderator who does not have permission to mention everyone can still make the bot send @everyone or @here if the bot has that permission. This issue has been patched in version 1.0.4.
Title Quest Bot: Moderation reason fields allow bot-powered `@everyone` / `@here` pings
Weaknesses CWE-116
References
Metrics cvssV4_0

{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-06-11T18:29:43.264Z

Reserved: 2026-05-18T21:25:34.497Z

Link: CVE-2026-47175

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-06-11T19:16:45.730

Modified: 2026-06-11T20:58:18.123

Link: CVE-2026-47175

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-11T22:30:09Z

Weaknesses
  • CWE-116

    Improper Encoding or Escaping of Output