CVE-2026-54681: DiscordChatExporter: HTML attribute injection via unescaped emoji name in HTML export
DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, the VisitEmojiAsync method in DiscordChatExporter.Core/Exporting/HtmlMarkdownVisitor.cs interpolates emoji.Name into the alt attribute and emoji.Code into the title attribute without HTML entity encoding. This affects HTML exports regardless of the markdown setting. Discord's current custom emoji name validation normally excludes attribute-breaking characters, but tampered offline input, a relaxed upstream validation rule, or another future metadata source can inject an HTML attribute and execute script when a user opens the export. This issue is fixed in version 2.47.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DiscordChatExporterto a version that resolves this vulnerability.Fixed in 2.47.2 - Operational
Regenerate any previously generated HTML exports produced by versions prior to 2.47.2, since the VisitEmojiAsync method interpolates emoji.Name into the alt attribute and emoji.Code into the title attribute without HTML entity encoding.
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Users who open HTML exports generated from tampered offline Discord data, data from an upstream source with relaxed emoji-name validation, or a future metadata source that permits attribute-breaking characters are exposed. Current Discord custom emoji name validation normally prevents those characters, reducing exposure for ordinary live Discord exports.
Are exports affected when Markdown output is disabled?
Yes. The issue affects HTML exports regardless of the Markdown setting.
What does an attacker need to exploit this?
They need to cause an emoji name or code containing HTML attribute-breaking content to be included in data processed by the exporter. Script execution occurs when a user opens the resulting HTML export.
What should teams do if they cannot immediately upgrade?
Avoid generating or opening HTML exports from untrusted or modified offline input and from metadata sources that may not enforce Discord's current emoji-name validation. Treat existing HTML exports created from such sources as potentially unsafe to open.
How can I determine whether I am affected?
Versions prior to 2.47.2 are affected. Review whether those versions were used to create HTML exports from tampered offline data or sources with nonstandard emoji metadata validation.