CVE-2026-47196

An attacker with the `Manage Guild` permission executes the `/automod add` slash command and supplies only whitespace (e.g., a single space) as the `word` parameter. The bot trims the input to an empty string and stores it as a valid automod rule. After the rule is stored, every non-bot message sent in the guild triggers `content.includes("")`, which is always `true`, causing the bot to delete the message [ref_id=1]. No network-level or authentication bypass is required; the attacker simply uses a legitimate Discord slash-command option.

The issue resides in `apps/bot/src/commands/moderation/automod.ts` where the `chatInputRun` method trims user input but does not validate that the result is non-empty before storing it via `createAutoMod`. The stored empty string then causes `content.includes("")` to always evaluate to `true` in `apps/bot/src/listeners/messageCreate.ts`, making every non-bot guild message match the automod rule and be deleted [ref_id=1].

The patch in version 1.1.6 adds a validation step after trimming the user-supplied `word` parameter in the automod add command. If the trimmed result is an empty string, the command rejects the input with an error instead of storing it. This prevents the creation of a rule whose `word` is the empty string, thereby ensuring that the `content.includes()` check in the message listener never matches every message unconditionally [ref_id=1].