CVE-2026-47175 Quest Bot: Moderation reason fields allow bot-powered `@everyone` / `@here` pings
Moderators can bypass mention restrictions by injecting @everyone or @here into reason fields, causing the bot to send unauthorized mass notifications.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-47175?
CVE-2026-47175 is a low-severity vulnerability in duck-organization quest-bot, published on 11 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.4, several moderation commands echo user-controlled reason text in public bot replies without disabling mention parsing. A moderator who does not have permission to mention everyone can still make the bot send @everyone or @here if the bot has that permission. This issue has been patched in version 1.0.4.
Weakness: CWE-116
Which versions are affected by CVE-2026-47175?
How do I fix CVE-2026-47175?
No fix has been published for CVE-2026-47175 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-47175 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-47175 exists.
Sources
Also known as GHSA-556x-7wgq-25fp.