Vulnerability · Published Jun 11, 2026 · Assigned by GitHub_M

CVE-2026-47188Quest Bot: Unban and unwarn reason fields still allow bot-powered mass mentions.

Low 2.3

In plain English

A low-severity security flaw in quest-bot from duck-organization. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 4.0)2.3Low

Exploit odds (30 days)0.3%top 77.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.5, the latest release suppresses mentions in several moderation commands, but /unban and /unwarn still echo user-controlled reason text in public bot messages without allowedMentions. A moderator can use @everyone or @here in the reason and make the bot send a mass ping. This issue has been patched in version 1.0.5.

Affected products (as reported)

Vendor	Product	Versions
duck-organization	quest-bot	< 1.0.5

Weakness: CWE-116 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

References

https://github.com/duck-organization/questbot/security/advisories/GHSA-r978-qqg9-vvxw x_refsource_CONFIRM
https://github.com/duck-organization/questbot/releases/tag/questbot-v1.0.5 x_refsource_MISC