Perceptive Security SOC/SIEM Consultancy
🇳🇱 🇬🇧
← Back to overview
Criticality: High · ·Source: nvd.nist.gov

DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, HTML exports generated with markdown formatting disabled pass attacker-controlled content through FormatMarkdownAsync and FormatEmbedMarkdownAsync in DiscordChatExporter.Core/Exporting/MessageGroupTemplate.cshtml and render it without HTML entity encoding. The affected fields include message.Content, message.ForwardedMessage.Content, message.ReferencedMessage.Content, embed.Title, embed.Description, field.Name, and field.Value. A Discord webhook or bot can store a script payload in these fields, and the payload executes when a user exports the channel with markdown formatting disabled and opens the resulting HTML, allowing the script to read the export or alter its displayed content. This issue is fixed in version 2.47.2.

CVE-2026-54682 is a stored Cross-Site Scripting (XSS) vulnerability in DiscordChatExporter prior to version 2.47.2. When HTML exports are generated with markdown formatting disabled, attacker-controlled content is passed through FormatMarkdownAsync and FormatEmbedMarkdownAsync without HTML entity encoding. Affected fields include message content, forwarded/referenced message content, embed titles, descriptions, and field names/values. A malicious Discord webhook or bot can inject script payloads into these fields. The payload executes when a victim exports the channel to HTML and opens the resulting file in a browser. This allows the attacker to read export contents or alter displayed content. The vulnerability is fixed in DiscordChatExporter version 2.47.2.

Affected products

  • DiscordChatExporter < 2.47.2

Related CVE's

  • CVE-2026-54682

Categories

  • Email & Messaging
  • Web Technologies

Related links