CVE-2026-47196 Quest Bot: Empty automod rule causes every guild message to be deleted
An attacker can delete all guild messages by adding an empty automod rule, causing a denial of service in Quest Bot.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-47196?
CVE-2026-47196 is a high-severity vulnerability in duck-organization questbot, published on 12 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, the automod add command trims user input but does not reject an empty result. Adding a rule containing only whitespace stores an empty word. The message listener later checks content.includes(""), which is always true, causing the bot to delete every non-bot guild message. This issue has been patched in version 1.1.6.
Weakness: CWE-20
Which versions are affected by CVE-2026-47196?
How do I fix CVE-2026-47196?
No fix has been published for CVE-2026-47196 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-47196 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-47196 exists.
Sources
Also known as GHSA-fgwg-6px5-cxp5.