CVE-2026-47196 Overview
CVE-2026-47196 affects Quest Bot, an open-source Discord bot maintained by the duck-organization project. The vulnerability exists in versions prior to 1.1.6 and stems from improper input validation in the automod add command. The command trims user input but does not reject empty results. An authenticated user with permission to manage automod rules can add a rule containing only whitespace, which stores an empty word. The message listener subsequently evaluates content.includes(""), an expression that always returns true, causing the bot to delete every non-bot guild message. This is classified as an Improper Input Validation issue [CWE-20].
Critical Impact
A single whitespace-only automod rule causes the bot to delete all non-bot messages across an affected Discord guild, resulting in service-wide content destruction.
Affected Products
- Quest Bot (duck-organization/questbot) versions prior to 1.1.6
- Discord guilds running Quest Bot with automod features enabled
- Self-hosted deployments tracking the main branch before the 1.1.6 release
Discovery Timeline
- 2026-06-12 - CVE-2026-47196 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-47196
Vulnerability Analysis
The flaw resides in Quest Bot's automod rule management logic. When a user invokes the automod add command, the bot applies a trim operation to the supplied word argument. The trimmed value is then persisted to the automod ruleset without verifying that the result is non-empty. Submitting input consisting solely of whitespace characters produces an empty string after trimming, which is accepted as a valid rule.
The message listener iterates through stored automod entries and performs a substring match using JavaScript's String.prototype.includes() method. Calling content.includes("") on any string returns true by language specification. Every guild message processed by the listener matches the empty rule and is deleted, except for messages originating from bots which are excluded by an earlier filter.
The issue impacts the integrity and availability of guild conversations. Attackers do not need elevated Discord permissions beyond the ability to invoke the automod add command, which is typically delegated to moderators.
Root Cause
The root cause is missing post-sanitization validation. The handler trims whitespace but omits a length check before storing the rule. The downstream listener also fails to guard against empty pattern entries, allowing the degenerate includes("") comparison to short-circuit message moderation logic.
Attack Vector
Exploitation requires network access to the Discord guild and low-privileged authenticated access to the automod add command. No user interaction from other members is required. Once the empty rule is stored, every subsequent non-bot message in the guild is deleted until the rule is removed or the bot is upgraded. See the GitHub Security Advisory GHSA-fgwg-6px5-cxp5 for additional technical detail.
No public proof-of-concept exploit is required beyond invoking the automod add command with a whitespace-only argument. No verified exploit code is available; the vulnerability mechanism is described in prose only.
Detection Methods for CVE-2026-47196
Indicators of Compromise
- Sudden bulk deletion of non-bot messages across one or more Discord channels managed by Quest Bot.
- Automod rule storage containing entries whose word field is empty or composed solely of whitespace.
- Quest Bot audit log entries showing automod add invocations immediately preceding mass message deletion events.
Detection Strategies
- Query the bot's automod rule database or configuration file for entries where the stored word has zero length after trimming.
- Review Discord audit logs for MESSAGE_DELETE events attributed to the Quest Bot application across multiple channels in a short window.
- Compare deployed Quest Bot version against the fixed release 1.1.6 using the deployment manifest or package metadata.
Monitoring Recommendations
- Alert on anomalous spikes in bot-initiated message deletions per guild per minute.
- Monitor command invocations of automod add and correlate with subsequent moderation activity volume.
- Track Quest Bot version drift across self-hosted instances and flag any running a release earlier than 1.1.6.
How to Mitigate CVE-2026-47196
Immediate Actions Required
- Upgrade Quest Bot to version 1.1.6 or later from the QuestBot v1.1.6 release.
- Inspect the automod rule store and remove any entries whose trimmed word value is empty.
- Restrict access to the automod add command to trusted moderators until the upgrade is complete.
Patch Information
The maintainers released version 1.1.6 containing the fix. The patch adds validation that rejects empty results after trimming user input and prevents storage of zero-length automod entries. Refer to the QuestBot v1.1.6 release notes and the GitHub Security Advisory GHSA-fgwg-6px5-cxp5 for full remediation details.
Workarounds
- Temporarily disable the automod feature in Quest Bot configuration until the upgrade is applied.
- Revoke moderator permissions for invoking automod add until trusted members can audit existing rules.
- Add a pre-storage validation wrapper in self-maintained forks that rejects rule entries whose length is zero after trimming.
# Configuration example: upgrade Quest Bot to the patched release
git fetch --tags
git checkout questbot-v1.1.6
npm install
npm run start
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
