Skip to content
OpenAdvisories

Vendor

duck-organization

16 known vulnerabilities.

Products

quest-bot 10 questbot 5 duck-site 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.5
    CVE-2026-47174

    Duck Site: Untrusted pull request code can trigger privileged production deployment

    In Duck Site before version 1.0.1, the repository has a deploy workflow that runs after the build workflow completes. The build workflow runs on pull requests, while the deploy workflow runs with package-write permissions and deployment secrets. If an attacke…

    duck-organization duck-site
  • Critical 9.5
    CVE-2026-47172 Public exploit

    Quest Bot: Untrusted pull request code can be built and deployed by privileged `workflow_run` deployment.

    Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, the repository has a privileged deploy workflow that runs after the unprivileged build workflow completes. The build workflow runs on pull reque…

    duck-organization quest-bot