CVE-2026-47175

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-47175", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-18T21:25:34.497Z", "datePublished": "2026-06-11T18:29:43.264Z", "dateUpdated": "2026-06-13T02:29:58.367Z"}, "containers": {"cna": {"title": "Quest Bot: Moderation reason fields allow bot-powered `@everyone` / `@here` pings", "problemTypes": [{"descriptions": [{"cweId": "CWE-116", "lang": "en", "description": "CWE-116: Improper Encoding or Escaping of Output", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 2.3, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/duck-organization/questbot/security/advisories/GHSA-556x-7wgq-25fp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/duck-organization/questbot/security/advisories/GHSA-556x-7wgq-25fp"}, {"name": "https://github.com/duck-organization/questbot/releases/tag/questbot-v1.0.4", "tags": ["x_refsource_MISC"], "url": "https://github.com/duck-organization/questbot/releases/tag/questbot-v1.0.4"}], "affected": [{"vendor": "duck-organization", "product": "quest-bot", "versions": [{"version": "< 1.0.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-11T18:29:43.264Z"}, "descriptions": [{"lang": "en", "value": "Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.4, several moderation commands echo user-controlled reason text in public bot replies without disabling mention parsing. A moderator who does not have permission to mention everyone can still make the bot send @everyone or @here if the bot has that permission. This issue has been patched in version 1.0.4."}], "source": {"advisory": "GHSA-556x-7wgq-25fp", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/duck-organization/questbot/security/advisories/GHSA-556x-7wgq-25fp", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-13T02:29:24.383805Z", "id": "CVE-2026-47175", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-13T02:29:58.367Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-47175", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-13T02:29:24.383805Z"}}}], "references": [{"url": "https://github.com/duck-organization/questbot/security/advisories/GHSA-556x-7wgq-25fp", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-13T02:29:52.056Z"}}], "cna": {"title": "Quest Bot: Moderation reason fields allow bot-powered `@everyone` / `@here` pings", "source": {"advisory": "GHSA-556x-7wgq-25fp", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.3, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "duck-organization", "product": "quest-bot", "versions": [{"status": "affected", "version": "< 1.0.4"}]}], "references": [{"url": "https://github.com/duck-organization/questbot/security/advisories/GHSA-556x-7wgq-25fp", "name": "https://github.com/duck-organization/questbot/security/advisories/GHSA-556x-7wgq-25fp", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/duck-organization/questbot/releases/tag/questbot-v1.0.4", "name": "https://github.com/duck-organization/questbot/releases/tag/questbot-v1.0.4", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.4, several moderation commands echo user-controlled reason text in public bot replies without disabling mention parsing. A moderator who does not have permission to mention everyone can still make the bot send @everyone or @here if the bot has that permission. This issue has been patched in version 1.0.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-116", "description": "CWE-116: Improper Encoding or Escaping of Output"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-11T18:29:43.264Z"}}}, "cveMetadata": {"cveId": "CVE-2026-47175", "state": "PUBLISHED", "dateUpdated": "2026-06-13T02:29:58.367Z", "dateReserved": "2026-05-18T21:25:34.497Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-11T18:29:43.264Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "quest-bot", "vendor": "duck-organization", "versions": [{"status": "affected", "version": "< 1.0.4"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.4, several moderation commands echo user-controlled reason text in public bot replies without disabling mention parsing. A moderator who does not have permission to mention everyone can still make the bot send @everyone or @here if the bot has that permission. This issue has been patched in version 1.0.4."}, {"lang": "es", "value": "Quest Bot es un bot de Discord moderno de c\u00f3digo abierto dise\u00f1ado para moderaci\u00f3n, utilidades y soporte. Antes de la versi\u00f3n 1.0.4, varios comandos de moderaci\u00f3n hac\u00edan eco del texto de raz\u00f3n controlado por el usuario en las respuestas p\u00fablicas del bot sin deshabilitar el an\u00e1lisis de menciones. Un moderador que no tiene permiso para mencionar a @everyone a\u00fan puede hacer que el bot env\u00ede @everyone o @here si el bot tiene ese permiso. Este problema ha sido parcheado en la versi\u00f3n 1.0.4."}], "id": "CVE-2026-47175", "lastModified": "2026-10-26T11:10:00.157", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.3, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47175", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-06-13T02:29:24.383805Z", "version": "2.0.3"}}]}, "published": "2026-06-11T19:16:45.730", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/duck-organization/questbot/releases/tag/questbot-v1.0.4"}, {"source": "security-advisories@github.com", "url": "https://github.com/duck-organization/questbot/security/advisories/GHSA-556x-7wgq-25fp"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/duck-organization/questbot/security/advisories/GHSA-556x-7wgq-25fp"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-116"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.0.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "quest-bot", "source": "cna", "vendor": "duck-organization"}, "product": "quest-bot", "vendor": "duck-organization"}], "created": "2026-06-11T21:30:05.471314+00:00", "updated": "2026-06-12T20:22:03.779966+00:00", "vendors": ["duck-organization", "duck-organization$PRODUCT$quest-bot"]}