# CVE-2026-48485: Quest Bot improper output escaping in /warns command

Source: https://junglewise.ai/threats/cve-2026-48485-quest-bot-improper-output-escaping-in-warns-command  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-12. Updated: 2026-06-12  
License: CC BY 4.0 with a link back

CVE-2026-48485 · Severity: info · CVSS 2.1 · Published 2026-06-12

Quest Bot is an open-source tool used to manage moderation tasks on Discord servers. A vulnerability in the warning system allows moderators to bypass restrictions and trigger mass notifications (pings) to all members of a server. This could be used to disrupt large communities or send unauthorized mass messages that appear to come from a trusted bot.

Technologies: [Duck-Organization Quest Bot](https://junglewise.ai/threats/technologies/quest-bot). Vendors: [Duck-Organization](https://junglewise.ai/threats/vendors/duck-organization).

## Quick answers

**Is CVE-2026-48485 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48485 being exploited in the wild.

**How severe is CVE-2026-48485?** Informational severity, with a CVSS score of 2.1, published 12 June 2026.

**Which products and versions are affected?** Duck-Organization Quest Bot <= 1.1.5.

**Is there a fix for CVE-2026-48485?** A patch was published on 2026-05-21: Version 1.1.6 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48485 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-48485?** Check whether you run Duck-Organization Quest Bot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Quest Bot (prior to version 1.1.6) fails to implement mention suppression when displaying stored warning reasons via the /warns command. While the bot correctly suppresses mentions during the initial /warn command, the 'reason' string is stored in the database without sanitization or encoding. When a user later invokes /warns, the bot outputs the raw string containing @everyone or @here tags. If the bot has the 'Mention @everyone, @here, and All Roles' permission in the Discord guild, this results in a mass notification. This is classified as improper encoding or escaping of output (CWE-116). The issue is patched in version 1.1.6.

## Affected products

- duck-organization Quest Bot <= 1.1.5

## Timeline

- 2026-05-21: patched: Version 1.1.6 released
- 2026-06-12: disclosed: CVE-2026-48485 published

## References

- [https://github.com/duck-organization/questbot/releases/tag/questbot-v1.1.6](https://github.com/duck-organization/questbot/releases/tag/questbot-v1.1.6)
- [https://github.com/duck-organization/questbot/security/advisories/GHSA-xjm4-8ggw-8jwf](https://github.com/duck-organization/questbot/security/advisories/GHSA-xjm4-8ggw-8jwf)

## Related threats

- [duck-organization Quest Bot resource exhaustion via ticket creation](https://junglewise.ai/threats/cve-2026-49347-duck-organization-quest-bot-resource-exhaustion-via-ticket)
- [Quest Bot Discord role hierarchy bypass in moderation commands](https://junglewise.ai/threats/cve-2026-47197-quest-bot-discord-role-hierarchy-bypass-in-moderation-commands)
- [Quest Bot improper input validation in automod command](https://junglewise.ai/threats/cve-2026-47196-quest-bot-improper-input-validation-in-automod-command)
- [Quest Bot incorrect authorization in purge and slowmode commands](https://junglewise.ai/threats/cve-2026-47195-quest-bot-incorrect-authorization-in-purge-and-slowmode-commands)
- [Quest Bot authorization bypass in AutoMod rule removal](https://junglewise.ai/threats/cve-2026-47189-quest-bot-authorization-bypass-in-automod-rule-removal)