Quest Bot's automod add command trims user input but does not reject an empty result. This oversight allows the creation of an automod rule that contains only whitespace, which is stored as an empty string. The bot's message listener later checks if message content includes an empty string. Because every string contains an empty string, that condition is always true, causing the bot to delete every non‑bot message in the guild.

The vulnerability affects the Duck Organization Quest Bot for Discord. Versions earlier than v1.1.6 are impacted. The bot operates within Discord guilds and leverages Discord’s API; any guild where the bot is installed with automod add permissions is at risk.

The CVSS vector shows a score of 8.4, indicating high severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. Since the exploit requires the ability to add automod rules, an attacker would need at least administrator permissions in the Discord server or control over the bot's command interface. The attack is straightforward and does not require advanced techniques, but its impact is drastic, eliminating all guild messages.