CVE-2026-47196
Quest Bot is an opensource Discord Bot
Published: 2026-06-12 · Last updated: 2026-06-12
Severity and scoring
- CWE
- CWE-20
Description
Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, the automod add command trims user input but does not reject an empty result. Adding a rule containing only whitespace stores an empty word. The message listener later checks content.includes(""), which is always true, causing the bot to delete every non-bot guild message. This issue has been patched in version 1.1.6.
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-47196
- [Other]https://github.com/duck-organization/questbot/releases/tag/questbot-v1.1.6
- [Other]https://github.com/duck-organization/questbot/security/advisories/GHSA-fgwg-6px5-cxp5
- [Other]https://github.com/duck-organization/questbot/security/advisories/GHSA-fgwg-6px5-cxp5
Related CVEs
Same CWE
- CVE-2026-45013 — ApostropheCMS is an open-source Node.js content management system (8.1 HIGH)
- CVE-2026-54133 — jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elements from a JSON document, in PHP app... (9.8 CRITICAL)
- CVE-2026-50633 — A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an atta... (8.1 HIGH)
- CVE-2026-50632 — A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been ide... (8.1 HIGH)
- CVE-2026-50628 — A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests fr...