CVE-2026-47171: Quest Bot: Reminder messages allow stored mass mentions through `@everyone` and `@here`

Synopsis

Stored mass-mention injection in Quest Bot (duck-organization/quest-bot) allows any unprivileged user to embed `@everyone` or `@here` into a reminder message. When the reminder fires, the bot replays the stored message into the channel without sanitizing mass-mention tokens, so the ping reaches the entire server or channel if the bot holds mention-everyone permission. No fix version has been published upstream yet; HarborGuard tracks the advisory and will make a patched-image rebuild available the moment a fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker submits the malicious reminder over the network via Discord's API, so the bot's network-exposed command interface must be reachable.

• AuthenticationNot required

  Any normal Discord user account is sufficient; no elevated privileges or special role membership are needed to create a reminder.

• Victim interactionNot required

  No action from a moderator or other user is required; the bot delivers the mass-mention autonomously when the reminder timer expires.

• Attack complexityDetail

  Exploitation is reliable and condition-free once the reminder is saved; the attacker only needs to wait for the scheduled trigger time.

Blast Radius

• Modifies channel notification state by forcibly pinging all server members or all online members, bypassing any channel slowmode or mention restrictions set by moderators.
• Allows a low-privilege user to weaponize the bot's elevated mention-everyone permission, escalating their effective reach beyond what Discord's own role system would normally permit them.
• Repeated or timed mass-mention floods can disrupt server communication and degrade the experience for all members, constituting a denial-of-normal-use condition.