Quest Bot CVE-2026-47196

The attacker must already possess privileges sufficient to invoke the Quest Bot automod add slash/text command in the target Discord guild (CVSS PR:L - typically a guild moderator or admin role granted by the server owner), the bot must be running a version prior to 1.1.6 with the automod feature in use, and the payload must be a whitespace-only string so that post-trim storage yields the empty string consumed by the includes("") check. No end-user interaction is required (UI:N) beyond ordinary members posting messages that then get deleted, and exploitation is confined to guilds where the vulnerable bot is installed.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with high integrity and availability impacts to both vulnerable and subsequent systems yields a score of 8.4, which is plausible: any low-privileged user who can issue the automod add command (typically a server moderator or admin role configured by the guild owner) can permanently disrupt server communication until the bot is removed or the rule is cleared. There is no EPSS, KEV, or SSVC data provided, and no public exploit identified at time of analysis, but the trigger is a single whitespace string so exploitability is effectively trivial once configuration access is obtained. Real-world risk is limited by the small install base typical of niche Discord bots and by the fact that the attacker must already hold privileged automod-configuration rights in the target guild, making this more of a sabotage/insider-misuse risk than a mass-exploitation concern.

A guild moderator with permission to manage automod rules issues the bot's automod add command with a value consisting solely of spaces; the server trims it to an empty string and stores it as a banned word. From that point onward, every non-bot message posted in the guild matches the empty rule and is deleted by the bot, effectively silencing the channel until an administrator removes the rule or uninstalls the bot.