CVE-2026-54681 in DiscordChatExporter
Summary
by MITRE • 08/21/2026
DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, the VisitEmojiAsync method in DiscordChatExporter.Core/Exporting/HtmlMarkdownVisitor.cs interpolates emoji.Name into the alt attribute and emoji.Code into the title attribute without HTML entity encoding. This affects HTML exports regardless of the markdown setting. Discord's current custom emoji name validation normally excludes attribute-breaking characters, but tampered offline input, a relaxed upstream validation rule, or another future metadata source can inject an HTML attribute and execute script when a user opens the export. This issue is fixed in version 2.47.2.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/21/2026
The vulnerability identified involves a Cross-Site Scripting (XSS) flaw within DiscordChatExporter versions prior to 2.47.2, specifically located in the VisitEmojiAsync method of the HtmlMarkdownVisitor component. This tool is designed to export chat logs from Discord into various formats, including HTML. The core technical failure lies in the handling of emoji metadata during the generation of these HTML exports. When processing emojis, the software directly interpolates the emoji.Name property into the alt attribute and the emoji.Code property into the title attribute of the resulting HTML elements without applying any form of HTML entity encoding or sanitization. This lack of input validation creates a direct pathway for malicious code injection if untrusted data is introduced into these fields.
Under normal operational conditions, Discord's server-side validation rules restrict custom emoji names to exclude characters that could break HTML attributes, such as quotes or angle brackets. Consequently, typical usage scenarios do not trigger this vulnerability because the source data remains safe. However, the security posture relies entirely on the integrity of upstream inputs and future metadata sources. If a user imports tampered offline input files, utilizes a version of Discord with relaxed validation rules, or encounters another external metadata source that permits attribute-breaking characters in emoji names, the protection mechanism fails. In such scenarios, an attacker can craft specific emoji data containing malicious payloads, effectively bypassing the application's default safeguards.
The operational impact of this vulnerability is significant for users who generate and subsequently view HTML exports containing these crafted emojis. When a victim opens the exported file in a web browser, the embedded script within the alt or title attributes executes automatically due to the lack of encoding. This constitutes an Stored Cross-Site Scripting attack vector because the malicious payload persists within the generated export files rather than being transiently passed via URL parameters. The execution context allows for potential session hijacking, credential theft, defacement of the exported content, or further propagation if the file is shared with other users who also open it in a vulnerable browser environment.
This vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The attack vector leverages user interaction to trigger execution, mapping closely to MITRE ATT&CK technique T1059.007, specifically JavaScript via browser-based interactions. To mitigate this risk, users must upgrade DiscordChatExporter to version 2.47.2 or later, where the developers have implemented proper HTML entity encoding for both the alt and title attributes during export generation. Until an update is applied, administrators should exercise extreme caution when processing offline emoji data sources and avoid opening generated HTML exports in untrusted environments until the patch is verified as effective against attribute-breaking inputs.