CVE-2026-47171CWE-116

Quest Bot: Reminder messages allow stored mass mentions through `@everyone` and `@here`

High · published June 11, 2026

CVSS v4.0
8.8
EPSS
0%
Percentile
37.7
In the wild
Unconfirmed
What it is

Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, a normal user can create a reminder whose message contains @everyone or @here. When the reminder triggers, the bot sends the stored message back into the channel without suppressing mass mentions. If the bot has permission to mention everyone, the reminder can ping the entire server or channel later. This issue has been patched in version 1.0.3.

The record
Technical detail
CVSS v4.0
8.8 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
EPSS
0.00445 · 37.7th percentile
Weakness
CWE-116 · Improper Encoding or Escaping of Output
Published
2026-06-11T18:28Z
EPSS history
Timeline
  • 11 JUN 18:28Z
    Quest Bot: Reminder messages allow stored mass mentions through `@everyone` and `@here`
    cvelistv5