# CVE-2026-47188: Quest Bot improper output escaping in unban and unwarn commands

Source: https://junglewise.ai/threats/cve-2026-47188-quest-bot-improper-output-escaping-in-unban-and-unwarn-commands  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-11. Updated: 2026-06-11  
License: CC BY 4.0 with a link back

CVE-2026-47188 · Severity: info · CVSS 2.3 · Published 2026-06-11

Quest Bot is an open-source Discord bot used for server moderation and utility tasks. A flaw in the bot's unban and unwarn commands allows moderators to bypass standard mention restrictions to send mass notifications (like @everyone) to the entire server. This can be used to harass users or disrupt server operations by sending unauthorized pings that appear to come from a trusted bot.

Technologies: [Duck-Organization Quest Bot](https://junglewise.ai/threats/technologies/quest-bot). Vendors: [Duck-Organization](https://junglewise.ai/threats/vendors/duck-organization).

## Quick answers

**Is CVE-2026-47188 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47188 being exploited in the wild.

**How severe is CVE-2026-47188?** Informational severity, with a CVSS score of 2.3, published 11 June 2026.

**Which products and versions are affected?** Duck-Organization Quest Bot < 1.0.5.

**Is there a fix for CVE-2026-47188?** A patch was published on 2026-05-18: Version 1.0.5 released to fix the issue. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47188 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-47188?** Check whether you run Duck-Organization Quest Bot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Quest Bot prior to version 1.0.5 is vulnerable to improper encoding or escaping of output (CWE-116) within its moderation modules. Specifically, the 'unban' and 'unwarn' commands fail to utilize the 'allowedMentions' property when echoing user-provided 'reason' text back to public channels. An attacker with basic moderator privileges (e.g., 'Ban Members' or 'Moderate Members') can include @everyone or @here tags in the reason field. The bot then broadcasts these mentions in a confirmation message, effectively bypassing Discord's standard permission checks for mass mentions. This issue is resolved in version 1.0.5.

## Affected products

- duck-organization Quest Bot < 1.0.5

## Timeline

- 2026-05-18: patched: Version 1.0.5 released to fix the issue.
- 2026-06-11: disclosed: CVE-2026-47188 published.

## References

- [https://github.com/duck-organization/questbot/releases/tag/questbot-v1.0.5](https://github.com/duck-organization/questbot/releases/tag/questbot-v1.0.5)
- [https://github.com/duck-organization/questbot/security/advisories/GHSA-r978-qqg9-vvxw](https://github.com/duck-organization/questbot/security/advisories/GHSA-r978-qqg9-vvxw)

## Related threats

- [duck-organization Quest Bot resource exhaustion via ticket creation](https://junglewise.ai/threats/cve-2026-49347-duck-organization-quest-bot-resource-exhaustion-via-ticket)
- [Quest Bot improper output escaping in /warns command](https://junglewise.ai/threats/cve-2026-48485-quest-bot-improper-output-escaping-in-warns-command)
- [Quest Bot Discord role hierarchy bypass in moderation commands](https://junglewise.ai/threats/cve-2026-47197-quest-bot-discord-role-hierarchy-bypass-in-moderation-commands)
- [Quest Bot improper input validation in automod command](https://junglewise.ai/threats/cve-2026-47196-quest-bot-improper-input-validation-in-automod-command)
- [Quest Bot incorrect authorization in purge and slowmode commands](https://junglewise.ai/threats/cve-2026-47195-quest-bot-incorrect-authorization-in-purge-and-slowmode-commands)