Vulnerability Description
Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, a normal user can create a reminder whose message contains @everyone or @here. When the reminder triggers, the bot sends the stored message back into the channel without suppressing mass mentions. If the bot has permission to mention everyone, the reminder can ping the entire server or channel later. This issue has been patched in version 1.0.3.
Related Weaknesses (CWE)
References
- https://github.com/duck-organization/questbot/releases/tag/questbot-v1.0.3
- https://github.com/duck-organization/questbot/security/advisories/GHSA-vmgg-f3m4
- https://github.com/duck-organization/questbot/security/advisories/GHSA-vmgg-f3m4
FAQ
What is CVE-2026-47171?
CVE-2026-47171 is a documented vulnerability. Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, a normal user can create a reminder whose message contains @everyone or @here. When t...
How severe is CVE-2026-47171?
CVSS scoring is not yet available for CVE-2026-47171. Check NVD for updates.
Is there a patch for CVE-2026-47171?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.