PatchSiren cyber security CVE debrief
CVE-2026-47196 duck-organization CVE debrief
CVE-2026-47196 is a HIGH severity vulnerability in Quest Bot, an open-source Discord Bot. The automod add command trims user input but does not reject an empty result. Adding a rule containing only whitespace stores an empty word. The message listener later checks content.includes(''), which is always true, causing the bot to delete every non-bot guild message. This issue has been patched in version 1.1.6.
- Vendor
- duck-organization
- Product
- questbot
- CVSS
- HIGH 8.4
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-12
- Original CVE updated
- 2026-06-12
- Advisory published
- 2026-06-12
- Advisory updated
- 2026-06-12
Who should care
Users of Quest Bot, specifically those who manage or interact with Discord servers that utilize the bot, should be aware of this vulnerability. The vulnerability could allow an attacker to disrupt communication in Discord guilds by causing the bot to delete messages.
Technical summary
The Quest Bot's automod add command does not properly handle empty input after trimming. This allows an attacker to create a rule with only whitespace, which the bot stores as an empty word. When the bot's message listener checks for content using content.includes(''), it always returns true, resulting in the bot deleting all non-bot messages in guilds.
Defensive priority
HIGH
Recommended defensive actions
- Update Quest Bot to version 1.1.6 or later to patch the vulnerability.
- Review and restrict automod commands to trusted users.
- Monitor bot activity and guild messages for unusual deletion patterns.
Evidence notes
The vulnerability was patched in version 1.1.6 of Quest Bot. References to the patched version and advisory can be found at [ref-4](https://github.com/duck-organization/questbot/releases/tag/questbot-v1.1.6) and [ref-5](https://github.com/duck-organization/questbot/security/advisories/GHSA-fgwg-6px5-cxp5).
Official resources
CVE-2026-47196 was published on 2026-06-12T13:16:33.527Z and modified on 2026-06-12T16:16:29.797Z.