CVE-2026-47175CWE-116

Quest Bot: Moderation reason fields allow bot-powered `@everyone` / `@here` pings

Low · published June 11, 2026

CVSS v4.0
2.3
EPSS
0%
Percentile
32.8
In the wild
Unconfirmed
What it is

Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.4, several moderation commands echo user-controlled reason text in public bot replies without disabling mention parsing. A moderator who does not have permission to mention everyone can still make the bot send @everyone or @here if the bot has that permission. This issue has been patched in version 1.0.4.

The record
Technical detail
CVSS v4.0
2.3 · LOW
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00397 · 32.8th percentile
Weakness
CWE-116 · Improper Encoding or Escaping of Output
Published
2026-06-11T18:29Z
EPSS history
Timeline
  • 11 JUN 18:29Z
    Quest Bot: Moderation reason fields allow bot-powered `@everyone` / `@here` pings
    cvelistv5