Executive Summary

CVE-2026-47196 is a vulnerability in the Quest Bot, an open-source Discord bot, affecting versions 1.1.5 and earlier. The issue occurs because the automod add command trims user input but does not reject inputs that become empty after trimming. If a user adds a rule containing only whitespace, it stores an empty string as the automod word.

Later, the bot's message listener checks if any message content includes this empty string, which is always true. As a result, the bot deletes every non-bot guild message, causing widespread disruption.

This flaw allows a user with Manage Guild permissions to disrupt normal chat across the server by creating an empty automod rule, even if they do not have direct message management permissions. The vulnerability was patched in version 1.1.6.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can severely disrupt the normal operation of a Discord server using the Quest Bot. Because the bot deletes every non-bot message when an empty automod rule is added, it effectively silences all user communication in the guild.

A user with Manage Guild permissions can exploit this to cause denial of service by preventing users from sending messages, impacting the availability and integrity of the server's communication.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the Quest Bot automod rules contain any entries that are empty strings or consist solely of whitespace characters.

Since the issue arises when a rule containing only whitespace is added, you can inspect the automod rules configuration or database for such entries.

There are no specific commands provided in the resources, but a general approach would be to query the bot's automod rules for empty or whitespace-only strings.

• Review the automod rules configuration files or database entries for empty or whitespace-only rules.
• Monitor the bot's logs for unusual mass deletion of non-bot guild messages, which may indicate exploitation.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade the Quest Bot to version 1.1.6 or later, where this vulnerability has been patched.

Until the upgrade is applied, avoid adding automod rules that contain only whitespace, as these trigger the vulnerability.

Additionally, restrict Manage Guild permissions to trusted users only, since users with this permission can exploit the vulnerability by adding malicious automod rules.

Useful 0 Not Useful 0