CVE-2026-54681: DiscordChatExporter: HTML attribute injection via unescaped emoji name in HTML export

Published Aug 21, 2026
·
Updated

DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, the VisitEmojiAsync method in DiscordChatExporter.Core/Exporting/HtmlMarkdownVisitor.cs interpolates emoji.Name into the alt attribute and emoji.Code into the title attribute without HTML entity encoding. This affects HTML exports regardless of the markdown setting. Discord's current custom emoji name validation normally excludes attribute-breaking characters, but tampered offline input, a relaxed upstream validation rule, or another future metadata source can inject an HTML attribute and execute script when a user opens the export. This issue is fixed in version 2.47.2.

Affected Software

1 affected component
DiscordChatExporter<2.47.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade DiscordChatExporter to a version that resolves this vulnerability.

    Fixed in 2.47.2
  2. Operational

    Regenerate any previously generated HTML exports produced by versions prior to 2.47.2, since the VisitEmojiAsync method interpolates emoji.Name into the alt attribute and emoji.Code into the title attribute without HTML entity encoding.

Event History

Aug 21, 2026
CVE Published
via MITRE·06:41 PM
Data Sourced
via MITRE·06:41 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

Who is realistically exposed to this issue?

Users who open HTML exports generated from tampered offline Discord data, data from an upstream source with relaxed emoji-name validation, or a future metadata source that permits attribute-breaking characters are exposed. Current Discord custom emoji name validation normally prevents those characters, reducing exposure for ordinary live Discord exports.

2

Are exports affected when Markdown output is disabled?

Yes. The issue affects HTML exports regardless of the Markdown setting.

3

What does an attacker need to exploit this?

They need to cause an emoji name or code containing HTML attribute-breaking content to be included in data processed by the exporter. Script execution occurs when a user opens the resulting HTML export.

4

What should teams do if they cannot immediately upgrade?

Avoid generating or opening HTML exports from untrusted or modified offline input and from metadata sources that may not enforce Discord's current emoji-name validation. Treat existing HTML exports created from such sources as potentially unsafe to open.

5

How can I determine whether I am affected?

Versions prior to 2.47.2 are affected. Review whether those versions were used to create HTML exports from tampered offline data or sources with nonstandard emoji metadata validation.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203