Duck-organization vulnerabilities
We track 9 vulnerabilities in Duck-organization products across 3 products. 9 are rated high or critical, and none are known to be exploited. The most recent was published on June 12, 2026.
Latest Duck-organization vulnerabilities
- 7.2 High severity
questbot: Missing Authorization
Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, a moderator with the relevant Discord permission bit can use the bot to moderate users above them in the Discord role hierarchy, as long as the bot itself outranks the target. This bypasses Discor
- 8.4 High severity
Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, the automod add command trims…
Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, the automod add command trims user input but does not reject an empty result. Adding a rule containing only whitespace stores an empty word. The message listener later checks content.includes(""),
- 7.1 High severity
questbot: Incorrect Authorization
Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, the purge and slowmode commands check only guild-level permissions on the invoking member. They do not check the member’s effective permissions in the channel where the command is run. A user deni
- 8.3 High severity
quest-bot: Authorization Bypass Through User-Controlled Key
Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.5, the AutoMod remove flow looks up and deletes rules by global database ID without verifying that the rule belongs to the guild where the command i
- 9.5 Critical severity
duck-site: Inclusion of Functionality from Untrusted Control Sphere
In Duck Site before version 1.0.1, the repository has a deploy workflow that runs after the build workflow completes. The build workflow runs on pull requests, while the deploy workflow runs with package-write permissions and deployment secrets. If an attacker
- 9.5 Critical severity
quest-bot: Inclusion of Functionality from Untrusted Control Sphere
Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, the repository has a privileged deploy workflow that runs after the unprivileged build workflow completes. The build workflow runs on pull reques
- 8.8 High severity
quest-bot: Improper Encoding or Escaping of Output
Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, a normal user can create a reminder whose message contains @everyone or @here. When the reminder triggers, the bot sends the stored message back
- 7.5 High severity
quest-bot: Incorrect Privilege Assignment
Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, a user with Manage Server / ManageGuild, but without Manage Roles or Administrator, can configure the bot’s AutoRole feature to assign an arbitra
- 7.2 High severity
quest-bot: Missing Authorization
Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.1, any guild member who can invoke slash commands can use /automod add, /automod remove, and /automod list because the command has no Discord defaul