Executive brief
Quest Bot is an open-source Discord bot used for server moderation and support. A security flaw in the bot's automated deployment process allows unauthorized individuals to deploy their own malicious code directly into the production environment. By submitting a specially crafted pull request, an attacker could take over the bot, access sensitive Discord tokens, and compromise the data of servers where the bot is installed.
Technical details
The vulnerability exists in the interaction between the unprivileged 'build' workflow and the privileged 'deploy' workflow (using the workflow_run trigger). The deploy workflow incorrectly validates the source of a build by only checking if the branch name is 'main'. An attacker can fork the repository, create a branch named 'main', and submit a pull request. Because the deploy workflow checks out the 'head_sha' of the triggering workflow rather than a trusted reference, it builds and deploys the attacker's code to production. This grants the attacker access to production secrets, including Discord tokens and database credentials. The issue is fixed in version 1.0.3 by improving workflow validation.
Affected products
- duck-organization Quest Bot <= 1.0.2
Timeline
- 2026-05-17: patched: Version 1.0.3 released to address the vulnerability.
- 2026-06-11: disclosed: CVE-2026-47172 published.