CVE-2026-47196

Quest Bot is a modern Discord bot that prior to version 1.0.3 had a privileged deployment process. An attacker could exploit a pull request from the main branch, allowing the deployment of malicious code in a privileged context.

Quest Bot is an open-source Discord bot. Prior to 1.1.9, the `image to GIF` command uses a request helper that validates a hostname's public IP addresses but then sends the actual request by hostname, causing a second DNS lookup. An attacker controlling a domain can return a public address during validation and an internal address during connection, bypassing internal-address protection through DNS rebinding. This is fixed in version 1.1.9.

Quest Bot is an open-source Discord bot that, prior to version 1.1.8, allowed users to repeatedly create new ticket channels without restrictions. The latest version still creates a new database ticket and Discord channel for every completed ticket modal submission, without checking if the same user already has an open ticket.

Quest Bot is an open-source Discord bot that prior to version 1.1.6 did not suppress mentions when invoking the /warns command, potentially leading to mass pings of users.

Quest Bot is an open-source Discord bot that prior to version 1.1.6 allowed moderators with the relevant permissions to moderate users above them in the Discord role hierarchy, as long as the bot itself outranked the target. This bypasses Discord's normal role hierarchy protections.

Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, the purge and slowmode commands check only guild-level permissions on the invoking member, allowing users without channel-level moderation permissions to delete messages or change slowmode.

Quest Bot is a modern Discord bot that prior to version 1.0.5 had a vulnerability in the AutoMod feature, allowing the removal of rules without verifying their association with the server. A user could identify the victim guild's AutoMod rule ID and remove it from another guild where they had Manage Server permissions.

Quest Bot is an open-source Discord bot that prior to version 1.0.5 did not suppress mentions in several moderation commands. The /unban and /unwarn commands still echoed user-controlled reason text in public bot messages, which could lead to mass pinging.

Quest Bot is an opensource modern Discord Bot that prior to version 1.0.4 allowed users to configure bot settings, including the ticket transcript channel. Users could set this channel to one they could read, leading to the exposure of private ticket messages.

Quest Bot is an open-source modern Discord Bot that, prior to version 1.0.4, allowed users to configure logging settings, resulting in the logging of deleted and edited message contents from every channel, including private ones that the configuring user could not access.