Skip to content
OpenAdvisories
Low · 2.3 CVE-2026-47188 EUVD-2026-36278

Quest Bot: Unban and unwarn reason fields still allow bot-powered mass mentions.

Published Jun 11, 2026 · Updated Jun 13, 2026 · Assigned by GitHub_M

Description

Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.5, the latest release suppresses mentions in several moderation commands, but /unban and /unwarn still echo user-controlled reason text in public bot messages without allowedMentions. A moderator can use @everyone or @here in the reason and make the bot send a mass ping. This issue has been patched in version 1.0.5.

Affected products

VendorProductAffectedFixed
duck-organization quest-bot < 1.0.5 —

References