PT-2026-48861 · Quest Bot · Quest-Bot

Published 2026-06-12 · Updated 2026-06-12 · CVE-2026-48485

Positive Technologies (AI Summary)

CVSS v4.0

2.1

Low

Base vector

AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Quest Bot versions prior to 1.1.6

Description Quest Bot suppresses mentions during several administrative actions, such as creating, unbanning, unwarning, kicking, muting, and unmuting. However, warning reasons stored in the system are printed by the /warns endpoint without mention suppression. This allows a moderator to include @everyone or @here in a warning reason, which can subsequently trigger a mass ping when the bot outputs that reason, provided the bot has the necessary permissions.

Recommendations Update to version 1.1.6.

Exploit

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

CVE-2026-48485

Affected Products

Quest-Bot

References · 4

• 🔥 https://github.com/duck-organization/questbot/security/advisories/GHSA-xjm4-8ggw-8jwf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-48485 · Security Note
• https://github.com/duck-organization/questbot/releases/tag/questbot-v1.1.6 · Note
• https://twitter.com/CVEnew/status/2065461509254246725 · Twitter Post