CVE-2026-54682: DiscordChatExporter: Stored XSS in HTML export when markdown formatting is disabled
DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, HTML exports generated with markdown formatting disabled pass attacker-controlled content through FormatMarkdownAsync and FormatEmbedMarkdownAsync in DiscordChatExporter.Core/Exporting/MessageGroupTemplate.cshtml and render it without HTML entity encoding. The affected fields include message.Content, message.ForwardedMessage.Content, message.ReferencedMessage.Content, embed.Title, embed.Description, field.Name, and field.Value. A Discord webhook or bot can store a script payload in these fields, and the payload executes when a user exports the channel with markdown formatting disabled and opens the resulting HTML, allowing the script to read the export or alter its displayed content. This issue is fixed in version 2.47.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DiscordChatExporterto a version that resolves this vulnerability.Fixed in 2.47.2
Event History
Frequently Asked Questions
Who can place a malicious payload into an affected export?
A Discord webhook or bot can store a script payload in message content, forwarded or referenced message content, and embed titles, descriptions, field names, or field values. The payload is then included when the relevant channel is exported.
What conditions are required for exploitation?
The export must be generated as HTML with markdown formatting disabled, and a user must open the resulting HTML file. The attacker does not need privileges in DiscordChatExporter itself, but must be able to cause attacker-controlled content to be stored in one of the affected Discord fields.
What is the impact if a malicious export is opened?
Script in the exported HTML can execute in the viewer's context, allowing it to read the export or alter the content displayed in it. Availability impact is not described.
What should be done if upgrading is not immediately possible?
Avoid generating HTML exports with markdown formatting disabled, particularly for channels that contain content from webhooks or bots. Treat existing HTML exports created under that setting as potentially unsafe to open if they include untrusted channel content.
How can I determine whether an export is affected?
Exports are affected if they were produced by a version earlier than 2.47.2 with markdown formatting disabled and contain untrusted values in the listed message or embed fields. Upgrade to version 2.47.2, which fixes the issue.