CVE-2026-47196

Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, the automod add command trims user input but does not reject an empty result. Adding a rule containing only whitespace stores an empty word. The message listener later checks content.includes(""), which is always true, causing the bot to delete every non-bot guild message. This issue has been patched in version 1.1.6.

CVSS

No CVSS.

References

Link	Resource
https://github.com/duck-organization/questbot/releases/tag/questbot-v1.1.6
https://github.com/duck-organization/questbot/security/advisories/GHSA-fgwg-6px5-cxp5
https://github.com/duck-organization/questbot/security/advisories/GHSA-fgwg-6px5-cxp5

Configurations

No configuration.

History

26 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Quest Bot es un bot de Discord de código abierto. Antes de la versión 1.1.6, el comando automod add recorta la entrada del usuario pero no rechaza un resultado vacío. Añadir una regla que contiene solo espacios en blanco almacena una palabra vacía. El oyente de mensajes comprueba más tarde content.includes(“”), lo cual siempre es cierto, haciendo que el bot elimine cada mensaje del gremio que no sea de un bot. Este problema ha sido parcheado en la versión 1.1.6.

Information

Published : 2026-06-12 13:16

Updated : 2026-10-26 11:10

NVD link : CVE-2026-47196

Mitre link : CVE-2026-47196

CVE.ORG link : CVE-2026-47196

JSON object : View

Products Affected

No product.

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2026-47196", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47196", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-12T14:38:27.646921Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.4, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "duck-organization", "product": "questbot", "versions": [{"status": "affected", "version": "< 1.1.6"}]}]}], "published": "2026-06-12T13:16:33.527", "references": [{"url": "https://github.com/duck-organization/questbot/releases/tag/questbot-v1.1.6", "source": "security-advisories@github.com"}, {"url": "https://github.com/duck-organization/questbot/security/advisories/GHSA-fgwg-6px5-cxp5", "source": "security-advisories@github.com"}, {"url": "https://github.com/duck-organization/questbot/security/advisories/GHSA-fgwg-6px5-cxp5", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, the automod add command trims user input but does not reject an empty result. Adding a rule containing only whitespace stores an empty word. The message listener later checks content.includes(\"\"), which is always true, causing the bot to delete every non-bot guild message. This issue has been patched in version 1.1.6."}, {"lang": "es", "value": "Quest Bot es un bot de Discord de c\u00f3digo abierto. Antes de la versi\u00f3n 1.1.6, el comando automod add recorta la entrada del usuario pero no rechaza un resultado vac\u00edo. A\u00f1adir una regla que contiene solo espacios en blanco almacena una palabra vac\u00eda. El oyente de mensajes comprueba m\u00e1s tarde content.includes(\u201c\u201d), lo cual siempre es cierto, haciendo que el bot elimine cada mensaje del gremio que no sea de un bot. Este problema ha sido parcheado en la versi\u00f3n 1.1.6."}], "lastModified": "2026-10-26T11:10:00.157", "sourceIdentifier": "security-advisories@github.com"}