CVE-2026-47172: critical vulnerability in duck-organization quest-bot
Quest Bot: Untrusted pull request code can be built and deployed by privileged `workflow_run` deployment.
Published
48Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 9.5epss 0.4%
from disclosure to weapon88 days
Published on NVDJun 11
1st PoC+88d
exploitation probability
0.4%top 63% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, the repository has a privileged deploy workflow that runs after the unprivileged build workflow completes. The build workflow runs on pull requests, and the deploy workflow checks out the triggering workflow’s head_sha, builds that code into a Docker image, pushes it as latest, and triggers production deployment. If an attacker can open a pull request from a branch named main, the deploy workflow condition can treat the PR build as deployable and build the attacker-controlled commit in a privileged deployment context. This can result in malicious container deployment and production bot compromise. This issue has been patched in version 1.0.3.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected products
duck-organization · quest-botpublic PoCs found — 1
githubgithub.com/pvharmo2/gha-lab-00d54c717d★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — duck-organization quest-bot
In the same product, most dangerous first.
CVE-2026-47173MEDIUMQuest Bot: Ticket reason allows mass-mention injectionEPSS 0.4%CVE-2026-47171HIGHQuest Bot: Reminder messages allow stored mass mentions through `@everyone` and `@here`EPSS 0.4%CVE-2026-47177MEDIUMQuest Bot: Ticket transcripts can disclose private ticket contents to a lower-visibility channelEPSS 0.4%CVE-2026-47176MEDIUMQuest Bot: Logging module can disclose private-channel message contents to a lower-visibility log channelEPSS 0.4%CVE-2026-47189HIGHQuest Bot: AutoMod removal can delete rules from another guild by global rule IDEPSS 0.4%CVE-2026-47169HIGHQuest Bot: Manage Server users can configure AutoRole to grant Administrator to controlled joining accountsEPSS 0.4%