CVE-2026-47173

The record

Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, a normal user can create a ticket with a reason containing @everyone, @here, user mentions, or role mentions. When the ticket is created, the bot posts the attacker-controlled reason into the new ticket channel without suppressing mentions. If the bot has permission to use those mentions, the attacker can make the bot ping staff or everyone with access to the ticket channel. This issue has been patched in version 1.0.3.

Affected packages

Related vulnerabilities

• CVE-2026-113732 virtualenv is a tool for creating isolated virtual python environments. CWE-116
• CVE-2026-113726 virtualenv is a tool for creating isolated virtual python environments. CWE-116
• CVE-2026-113725 virtualenv is a tool for creating isolated virtual python environments. CWE-116
• CVE-2026-104250 The unstructured library provides open-source components for ingesting and pre-processing… CWE-116
• CVE-2026-107823 MariaDB server is a community developed fork of MySQL server. CWE-116
• CVE-2026-106444 Handlebars provides the power necessary to let users build semantic templates. CWE-116
• CVE-2026-77404 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. CWE-116
• CVE-2026-88060 Angular is a development platform for building mobile and desktop web applications using… CWE-116