CVE-2026-47173 Details
Description
Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, a normal user can create a ticket with a reason containing @everyone, @here, user mentions, or role mentions. When the ticket is created, the bot posts the attacker-controlled reason into the new ticket channel without suppressing mentions. If the bot has permission to use those mentions, the attacker can make the bot ping staff or everyone with access to the ticket channel. This issue has been patched in version 1.0.3.
A vulnerability in Quest Bot, a modern open-source Discord bot for moderation and utilities, allows normal users to inject mentions into ticket reasons. This issue exists in versions prior to 1.0.3. When a ticket is created, the bot includes the user-controlled reason in the ticket channel without removing mention syntax. If the bot has permission to use mentions, this can result in unwanted pings to staff or others in the channel.
Users can update to Quest Bot version 1.0.3 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 11, 2026CISA-ADP
Assessed Jun 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/duck-organization/questbot/security/advisories/GHSA-27xg-395c-xfcx | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/duck-organization/questbot/releases/tag/questbot-v1.0.3 | [email protected] | Release NotesVendor |
| https://github.com/duck-organization/questbot/security/advisories/GHSA-27xg-395c-xfcx | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-116 | Improper Encoding or Escaping of Output | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Quest Bot | <= 1.0.3 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 12, 2026 | CVE Modified | CISA-ADP |
| Jun 11, 2026 | New CVE Received | [email protected] |