CVE-2026-61840 Details
Description
Quest Bot is an opensource Discord Bot. Prior to 1.1.9, the `image to GIF` command uses a request helper that validates a hostname's public IP addresses but then sends the actual request by hostname, causing a `second DNS lookup`. An attacker controlling a domain can return a public address during validation and an internal address during the connection, bypassing the internal-address protection through `DNS rebinding`. The command takes its address directly from user input and its developer-only gate is disabled in normal deployments, so any member of a server with the bot can trigger the flaw without special permissions. Requests are restricted to `HTTPS on port 443`, and content is returned only when the response is a `genuine image`. The impact is therefore mostly blind internal probing with limited retrieval of image responses from loopback or internal endpoints, not arbitrary internal-data disclosure. Common cloud metadata services using plain HTTP on another port are not reachable through this path. This issue is fixed in version 1.1.9.
A server-side request forgery vulnerability has been identified in Quest Bot, an open-source Discord bot, in versions prior to 1.1.9. The issue arises in the 'image to GIF' command, which improperly handles hostname validation for DNS lookups. The command accepts user-provided addresses and, due to a flaw in the validation process, an attacker can exploit this by controlling a domain to bypass internal address protections. This is achieved by returning a public IP during validation and an internal IP during the actual request, leveraging DNS rebinding. As a result, the bot can access internal services that would normally be unreachable. While the vulnerability allows for some probing of internal endpoints, it does not facilitate arbitrary internal data disclosure. The issue has been patched in version 1.1.9.
Users can update to Quest Bot version 1.1.9 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/vantern-org/questbot/commit/eec5f57eda8caa37cd46520c57b3c01efef2b99b | [email protected] | Source CodeVendor |
| https://github.com/vantern-org/questbot/security/advisories/GHSA-hrp5-g9r6-8rq4 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Quest Bot | <= 1.1.8 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |