Executive brief
Quest Bot is an open-source tool used to manage moderation tasks on Discord servers. A vulnerability in the warning system allows moderators to bypass restrictions and trigger mass notifications (pings) to all members of a server. This could be used to disrupt large communities or send unauthorized mass messages that appear to come from a trusted bot.
Technical details
Quest Bot (prior to version 1.1.6) fails to implement mention suppression when displaying stored warning reasons via the /warns command. While the bot correctly suppresses mentions during the initial /warn command, the 'reason' string is stored in the database without sanitization or encoding. When a user later invokes /warns, the bot outputs the raw string containing @everyone or @here tags. If the bot has the 'Mention @everyone, @here, and All Roles' permission in the Discord guild, this results in a mass notification. This is classified as improper encoding or escaping of output (CWE-116). The issue is patched in version 1.1.6.
Affected products
- duck-organization Quest Bot <= 1.1.5
Timeline
- 2026-05-21: patched: Version 1.1.6 released
- 2026-06-12: disclosed: CVE-2026-48485 published