CVE-2026-47175: Quest Bot: Moderation reason fields allow bot-powered `@everyone` / `@here` pings

Severity: low (CVSS 2.3 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-11 · updated 2026-10-26
Weakness: CWE-116

Description

Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.4, several moderation commands echo user-controlled reason text in public bot replies without disabling mention parsing. A moderator who does not have permission to mention everyone can still make the bot send @everyone or @here if the bot has that permission. This issue has been patched in version 1.0.4.

Affected products

duck-organization quest-bot: before 1.0.4

References

https://github.com/duck-organization/questbot/releases/tag/questbot-v1.0.4
https://github.com/duck-organization/questbot/security/advisories/GHSA-556x-7wgq-25fp
https://github.com/duck-organization/questbot/security/advisories/GHSA-556x-7wgq-25fp

Get alerted when CVE-2026-47175 or the next vulnerability affects your stack