Executive brief
Quest Bot is an open-source Discord bot used for server moderation and utility tasks. A flaw in the bot's unban and unwarn commands allows moderators to bypass standard mention restrictions to send mass notifications (like @everyone) to the entire server. This can be used to harass users or disrupt server operations by sending unauthorized pings that appear to come from a trusted bot.
Technical details
Quest Bot prior to version 1.0.5 is vulnerable to improper encoding or escaping of output (CWE-116) within its moderation modules. Specifically, the 'unban' and 'unwarn' commands fail to utilize the 'allowedMentions' property when echoing user-provided 'reason' text back to public channels. An attacker with basic moderator privileges (e.g., 'Ban Members' or 'Moderate Members') can include @everyone or @here tags in the reason field. The bot then broadcasts these mentions in a confirmation message, effectively bypassing Discord's standard permission checks for mass mentions. This issue is resolved in version 1.0.5.
Affected products
- duck-organization Quest Bot < 1.0.5
Timeline
- 2026-05-18: patched: Version 1.0.5 released to fix the issue.
- 2026-06-11: disclosed: CVE-2026-47188 published.