Quest Bot: Server Side Request Forgery in the Image to GIF Feature Lets Any Server Member Reach Internal Services
Impact
Quest Bot versions prior to 1.1.9 have a Server-Side Request Forgery (SSRF) vulnerability in the Image to GIF feature, allowing any server member to reach internal services through DNS rebinding. The impact is limited to blind internal probing with restricted content retrieval. An attacker must control a domain to exploit this weakness.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
vantern-org · GitHub_M
questbot
1 range
vantern-org · GitHub_M
questbot
Compare with this publisher’s ranges. This does not inspect your installation.
affected
< 1.1.9
Other versions: unknown
Original source description
Quest Bot is an opensource Discord Bot. Prior to 1.1.9, the image to GIF command uses a request helper that validates a hostname's public IP addresses but then sends the actual request by hostname, causing a second DNS lookup. An attacker controlling a domain can return a public address during validation and an internal address during the connection, bypassing the internal-address protection through DNS rebinding. The command takes its address directly from user input and its developer-only gate is disabled in normal deployments, so any member of a server with the bot can trigger the flaw without special permissions. Requests are restricted to HTTPS on port 443, and content is returned only when the response is a genuine image. The impact is therefore mostly blind internal probing with limited retrieval of image responses from loopback or internal endpoints, not arbitrary internal-data disclosure. Common cloud metadata services using plain HTTP on another port are not reachable through this path. This issue is fixed in version 1.1.9.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-61840View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changes- CVE · CVE-2026-61840
Observed 2026-10-30T22:48:01.119Z · upstream updated 2026-10-30T22:17:17.865Z
Prioritization updated
before
[]
after
[ { "source": "CISA-ADP", "type": "SSVC", "role": "CISA Coordinator", "timestamp": "2026-10-30T21:18:02.058575Z", "decisions": [ { "name": "Exploitation", "value": "none" }, { "name": "Automatable", "value": "no" }, { "name": "Technical Impact", "value": "partial" } ] } ]
Large field values are marked as truncated previews. Original source snapshots remain retained.
Showing up to 50 most recent observed changes.