{"id":"CVE-2026-61840","aliases":[],"cve":{"records":[{"id":"CVE-2026-61840","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-07-10T20:28:17.512Z","published":"2026-10-30T18:23:22.213Z","modified":"2026-10-30T22:17:17.865Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-30T18:23:22.213Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T22:17:17.865Z"}],"references":[{"url":"https://github.com/vantern-org/questbot/security/advisories/GHSA-hrp5-g9r6-8rq4","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/vantern-org/questbot/commit/eec5f57eda8caa37cd46520c57b3c01efef2b99b","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-918","description":"CWE-918: Server-Side Request Forgery (SSRF)","source":"GitHub_M"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T21:18:02.058575Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Quest Bot: Server Side Request Forgery in the Image to GIF Feature Lets Any Server Member Reach Internal Services","titleSource":"GitHub_M","descriptionSource":"GitHub_M","description":"Quest Bot is an opensource Discord Bot. Prior to 1.1.9, the `image to GIF` command uses a request helper that validates a hostname's public IP addresses but then sends the actual request by hostname, causing a `second DNS lookup`. An attacker controlling a domain can return a public address during validation and an internal address during the connection, bypassing the internal-address protection through `DNS rebinding`. The command takes its address directly from user input and its developer-only gate is disabled in normal deployments, so any member of a server with the bot can trigger the flaw without special permissions. Requests are restricted to `HTTPS on port 443`, and content is returned only when the response is a `genuine image`. The impact is therefore mostly blind internal probing with limited retrieval of image responses from loopback or internal endpoints, not arbitrary internal-data disclosure. Common cloud metadata services using plain HTTP on another port are not reachable through this path. This issue is fixed in version 1.1.9.","score":2.3,"severity":"low","published":"2026-10-30T18:23:22.213Z","modified":"2026-10-30T22:17:17.865Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"vantern-org","name":"questbot","platforms":[],"versions":[{"version":"< 1.1.9","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-61840"}],"remediation":[],"references":["https://github.com/vantern-org/questbot/security/advisories/GHSA-hrp5-g9r6-8rq4","https://github.com/vantern-org/questbot/commit/eec5f57eda8caa37cd46520c57b3c01efef2b99b"],"sources":[{"name":"CVE","id":"CVE-2026-61840","modified":"2026-10-30T22:17:17.865Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-61840"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N","score":2.3}],"sourceAffected":[],"observedAt":"2026-10-30T22:48:01.119Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T14:10:32.801Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T23:00:34.736Z","attemptedAt":"2026-10-30T23:00:34.736Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T23:00:34.096Z","attemptedAt":"2026-10-30T23:00:34.096Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T23:00:34.511Z","attemptedAt":"2026-10-30T23:00:34.511Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T23:00:34.733Z","attemptedAt":"2026-10-30T23:00:34.733Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-114279","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-114279","modified":"Oct 30, 2026, 6:23:22 PM","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N","checkedAt":"2026-10-30T23:00:34.511Z"},{"source":"NVD","id":"CVE-2026-61840","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61840","modified":"2026-10-30T19:39:14.897","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-10-30T23:00:34.736Z"}],"aiSummary":{"text":"Quest Bot versions prior to 1.1.9 have a Server-Side Request Forgery (SSRF) vulnerability in the Image to GIF feature, allowing any server member to reach internal services through DNS rebinding. The impact is limited to blind internal probing with restricted content retrieval. An attacker must control a domain to exploit this weakness.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-31T00:16:01.898Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-61840"}]}}