Stored XSS in Quest Bot via Moderation Commands

Executive Summary

CVE-2026-47175 is a vulnerability in the Quest Bot, an open-source Discord moderation bot. Before version 1.0.4, certain moderation commands like /ban, /kick, /mute, and /warn would echo user-provided reason text in public bot replies without disabling mention parsing.

This means a moderator who does not have permission to mention everyone can still cause the bot to send @everyone or @here mentions if the bot itself has that permission. An attacker can include these mentions in the reason field, triggering mass notifications in public confirmation messages before the moderation action is confirmed or even canceled.

The root cause is improper handling of user input, specifically a failure to sanitize or escape mention syntax, leading to unauthorized mass mentions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can be exploited to cause disruption in large Discord servers by sending unwanted mass notifications using @everyone or @here pings.

It allows attackers with limited moderation permissions to abuse the bot to send these notifications, even if they themselves do not have permission to mention everyone.

Such abuse can lead to spam, annoyance for server members, and damage to trust since the notifications appear to come from a trusted bot.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves monitoring bot replies for unexpected @everyone or @here mentions triggered by moderation commands such as /ban, /kick, /mute, and /warn.

Specifically, look for public bot confirmation messages that echo user-provided reason text containing @everyone or @here mentions, especially if the moderator issuing the command does not have permission to mention everyone.

Since the issue is related to the bot echoing unescaped mention syntax, you can audit bot logs or message histories for such patterns.

There are no specific commands provided in the available resources to detect this vulnerability on your system or network.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade the Quest Bot to version 1.0.4 or later, where this vulnerability has been patched.

Until the upgrade is applied, restrict the bot's permission to send @everyone or @here mentions to prevent abuse.

Additionally, limit the moderation permissions of users who can issue commands that echo reason text, or implement manual review of reason inputs to avoid mention abuse.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows attackers with limited moderation permissions to cause the bot to send unauthorized mass notifications using @everyone or @here mentions. This can lead to disruption and unwanted notifications in large servers.

However, there is no information provided that directly links this vulnerability to violations or impacts on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0