duck-organization quest-bot up to 1.0.2 escape output

Summaryinfo

A vulnerability categorized as critical has been discovered in duck-organization quest-bot up to 1.0.2. The affected element is an unknown function. Executing a manipulation can lead to escape output. This vulnerability is registered as CVE-2026-47173. It is possible to launch the attack remotely. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in duck-organization quest-bot up to 1.0.2. It has been declared as critical. This vulnerability affects an unknown functionality. The manipulation with an unknown input leads to a escape output vulnerability. The CWE definition for the vulnerability is CWE-116. The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved. As an impact it is known to affect integrity, and availability. CVE summarizes:

Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, a normal user can create a ticket with a reason containing @everyone, @here, user mentions, or role mentions. When the ticket is created, the bot posts the attacker-controlled reason into the new ticket channel without suppressing mentions. If the bot has permission to use those mentions, the attacker can make the bot ping staff or everyone with access to the ticket channel. This issue has been patched in version 1.0.3.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-47173 since 05/18/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available.

Upgrading to version 1.0.3 eliminates this vulnerability. The upgrade is hosted for download at github.com.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-36274). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• duck-organization

Name

• quest-bot

Version

• 1.0.0
• 1.0.1
• 1.0.2

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion