Vulnerability · Published Jun 12, 2026 · Assigned by GitHub_M

CVE-2026-47196Quest Bot: Empty automod rule causes every guild message to be deleted

High 8.4

In plain English

A high-severity improper input validation in questbot from duck-organization. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 4.0)8.4High

Exploit odds (30 days)0.3%top 77.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, the automod add command trims user input but does not reject an empty result. Adding a rule containing only whitespace stores an empty word. The message listener later checks content.includes(""), which is always true, causing the bot to delete every non-bot guild message. This issue has been patched in version 1.1.6.

Affected products (as reported)

Vendor	Product	Versions
duck-organization	questbot	< 1.1.6

Weakness: CWE-20 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:H

References

https://github.com/duck-organization/questbot/security/advisories/GHSA-fgwg-6px5-cxp5 x_refsource_CONFIRM
https://github.com/duck-organization/questbot/releases/tag/questbot-v1.1.6 x_refsource_MISC