# CVE-2026-47171: duck-organization Quest Bot improper output escaping in reminders

Source: https://junglewise.ai/threats/cve-2026-47171-duck-organization-quest-bot-improper-output-escaping-in-reminders  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-11. Updated: 2026-06-11  
License: CC BY 4.0 with a link back

CVE-2026-47171 · Severity: info · CVSS 5.3 · Published 2026-06-11

Quest Bot is an open-source Discord bot used for server moderation and utility tasks. A vulnerability in the reminder feature allows any user to schedule messages that trigger mass notifications (like @everyone) if the bot has the necessary permissions. This can be used to bypass typical user restrictions, causing widespread disruption and unwanted notifications across a Discord server.

Technologies: [Duck-Organization Quest Bot](https://junglewise.ai/threats/technologies/quest-bot). Vendors: [Duck-Organization](https://junglewise.ai/threats/vendors/duck-organization).

## Quick answers

**Is CVE-2026-47171 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47171 being exploited in the wild.

**How severe is CVE-2026-47171?** Informational severity, with a CVSS score of 5.3, published 11 June 2026.

**Which products and versions are affected?** Duck-Organization Quest Bot < 1.0.3.

**Is there a fix for CVE-2026-47171?** A patch was published on 2026-05-17: Version 1.0.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47171 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-47171?** Check whether you run Duck-Organization Quest Bot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Quest Bot prior to version 1.0.3 is vulnerable to improper output escaping (CWE-116) within its reminder functionality. The bot fails to sanitize user-provided strings or suppress mass mentions when replaying stored reminder messages. An attacker with basic user privileges can create a reminder containing '@everyone' or '@here' tags; when the scheduled task executes, the bot sends the message to the channel. If the bot has the 'Mention @everyone, @here, and All Roles' permission, Discord will process these as valid mass notifications. This issue is patched in version 1.0.3.

## Affected products

- duck-organization Quest Bot < 1.0.3

## Timeline

- 2026-05-17: patched: Version 1.0.3 released
- 2026-05-17: advisory: GitHub Security Advisory published
- 2026-06-11: disclosed: CVE published to NVD

## References

- [https://github.com/duck-organization/questbot/releases/tag/questbot-v1.0.3](https://github.com/duck-organization/questbot/releases/tag/questbot-v1.0.3)
- [https://github.com/duck-organization/questbot/security/advisories/GHSA-vmgg-f3m4-6fcv](https://github.com/duck-organization/questbot/security/advisories/GHSA-vmgg-f3m4-6fcv)

## Related threats

- [duck-organization Quest Bot resource exhaustion via ticket creation](https://junglewise.ai/threats/cve-2026-49347-duck-organization-quest-bot-resource-exhaustion-via-ticket)
- [Quest Bot improper output escaping in /warns command](https://junglewise.ai/threats/cve-2026-48485-quest-bot-improper-output-escaping-in-warns-command)
- [Quest Bot Discord role hierarchy bypass in moderation commands](https://junglewise.ai/threats/cve-2026-47197-quest-bot-discord-role-hierarchy-bypass-in-moderation-commands)
- [Quest Bot improper input validation in automod command](https://junglewise.ai/threats/cve-2026-47196-quest-bot-improper-input-validation-in-automod-command)
- [Quest Bot incorrect authorization in purge and slowmode commands](https://junglewise.ai/threats/cve-2026-47195-quest-bot-incorrect-authorization-in-purge-and-slowmode-commands)