CVE-2026-54682
Received Received - Intake

HTML Injection in DiscordChatExporter via Markdown Disabled Export

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description
DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, HTML exports generated with markdown formatting disabled pass attacker-controlled content through FormatMarkdownAsync and FormatEmbedMarkdownAsync in DiscordChatExporter.Core/Exporting/MessageGroupTemplate.cshtml and render it without HTML entity encoding. The affected fields include message.Content, message.ForwardedMessage.Content, message.ReferencedMessage.Content, embed.Title, embed.Description, field.Name, and field.Value. A Discord webhook or bot can store a script payload in these fields, and the payload executes when a user exports the channel with markdown formatting disabled and opens the resulting HTML, allowing the script to read the export or alter its displayed content. This issue is fixed in version 2.47.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-54682
EUVD
EUVD-2026-64047

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
tyrrrz discordchatexporter to 2.47.2 (exc)
discordchatexporter discordchatexporter 2.47.2
discordchatexporter discordchatexporter to 2.47.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

DiscordChatExporter versions before 2.47.2 have an HTML injection and XSS vulnerability. When markdown formatting is disabled during HTML export, attacker-controlled content in fields like message content or embed titles is processed without HTML encoding. This allows malicious JavaScript to be injected via Discord webhooks or bots. When users open the exported HTML file, the script executes, potentially reading export data or altering displayed content.

Detection Guidance

Check if you are using DiscordChatExporter versions 2.47.1 or earlier. Inspect exported HTML files for unexpected JavaScript execution when opened in a browser. Look for suspicious payloads in message content, embed titles, descriptions, or field values.

Impact Analysis

If you use DiscordChatExporter versions before 2.47.2 and export chats with markdown disabled, opening the HTML file could execute malicious scripts. This may lead to data theft from your export files or phishing attacks by altering what you see in the rendered HTML. The impact depends on the attacker's payload and your exported data.

Compliance Impact

This vulnerability could lead to unauthorized access or exfiltration of sensitive data during export, potentially violating GDPR or HIPAA requirements for data protection. If exported chat logs contain personal or health information, the lack of proper encoding may result in compliance breaches due to potential data exposure through XSS attacks.

Mitigation Strategies

Upgrade to DiscordChatExporter version 2.47.2 or later. Avoid disabling markdown formatting in HTML exports unless absolutely necessary. Review exported HTML files for malicious content before opening them.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54682. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart