CVE-2026-54681
Received Received - Intake

Cross-Site Scripting in DiscordChatExporter via Emoji Export

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description
DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, the VisitEmojiAsync method in DiscordChatExporter.Core/Exporting/HtmlMarkdownVisitor.cs interpolates emoji.Name into the alt attribute and emoji.Code into the title attribute without HTML entity encoding. This affects HTML exports regardless of the markdown setting. Discord's current custom emoji name validation normally excludes attribute-breaking characters, but tampered offline input, a relaxed upstream validation rule, or another future metadata source can inject an HTML attribute and execute script when a user opens the export. This issue is fixed in version 2.47.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-54681
EUVD
EUVD-2026-64048

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
tyrrrz discordchatexporter 2.47.2
discordchatexporter discordchatexporter to 2.47.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an HTML attribute injection flaw in DiscordChatExporter versions before 2.47.2. The VisitEmojiAsync method in HtmlMarkdownVisitor.cs directly inserts emoji.Name into the alt attribute and emoji.Code into the title attribute of HTML exports without HTML encoding. This allows potential cross-site scripting (XSS) if special characters or event handlers are injected through tampered offline input or relaxed upstream validation.

Detection Guidance

Check if your DiscordChatExporter version is below 2.47.2. Inspect exported HTML files for unencoded emoji names or codes in alt and title attributes. Look for suspicious script tags or event handlers like onload in these attributes.

Impact Analysis

If exploited, this vulnerability could allow an attacker to inject malicious scripts into exported HTML chat logs. When a user opens the infected export file, the script could execute, potentially stealing data or performing unauthorized actions. The impact depends on the user's privileges and the nature of the injected script.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches if exploited, potentially violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations using affected versions may face compliance risks due to potential exposure of sensitive data through XSS attacks.

Mitigation Strategies

Upgrade to DiscordChatExporter version 2.47.2 or later. Review exported HTML files for any signs of injected scripts. Avoid using untrusted emoji data sources until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54681. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart