CVE-2026-54682 in DiscordChatExporter
Summary
by MITRE • 08/21/2026
DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, HTML exports generated with markdown formatting disabled pass attacker-controlled content through FormatMarkdownAsync and FormatEmbedMarkdownAsync in DiscordChatExporter.Core/Exporting/MessageGroupTemplate.cshtml and render it without HTML entity encoding. The affected fields include message.Content, message.ForwardedMessage.Content, message.ReferencedMessage.Content, embed.Title, embed.Description, field.Name, and field.Value. A Discord webhook or bot can store a script payload in these fields, and the payload executes when a user exports the channel with markdown formatting disabled and opens the resulting HTML, allowing the script to read the export or alter its displayed content. This issue is fixed in version 2.47.2.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/21/2026
The vulnerability identified as CVE-2023-XXXX involves an improper neutralization of input during web page generation within DiscordChatExporter versions prior to 2.47.2. The application, which functions as a utility for exporting chat logs from the Discord platform into various formats including HTML, contains a critical flaw in its markdown processing logic when specific formatting options are disabled. Specifically, when users generate exports with markdown formatting turned off, the system fails to properly sanitize user-supplied content before rendering it within the resulting HTML document. This oversight allows maliciously crafted data stored by Discord webhooks or bots to be executed as active script code upon viewing the exported file in a standard web browser.
The technical root cause lies in the handling of message and embed fields through methods named FormatMarkdownAsync and FormatEmbedMarkdownAsync located in the MessageGroupTemplate.cshtml component of the DiscordChatExporter.Core module. These methods are designed to process text content for display but, under the condition where markdown rendering is disabled, they bypass necessary HTML entity encoding procedures. Consequently, any special characters that typically carry structural meaning in HTML or JavaScript remain unescaped. The affected data fields include message.Content, which represents standard chat messages; message.ForwardedMessage.Content and message.ReferencedMessage.Content, which handle forwarded or quoted text segments; as well as embed metadata such as embed.Title, embed.Description, field.Name, and field.Value. Because these fields are populated directly from Discord's API without adequate sanitization when markdown is disabled, they become vectors for injection attacks.
The operational impact of this vulnerability enables a stored cross-site scripting attack scenario. An attacker can manipulate a Discord webhook or bot to inject malicious JavaScript payloads into any of the aforementioned message or embed fields within a channel. When an unsuspecting user subsequently exports that specific channel using HTML format with markdown formatting disabled, the exported file will contain the raw script code rather than escaped text entities. Upon opening this HTML file in a browser, the embedded scripts execute automatically within the context of the local document. This execution allows the malicious payload to read sensitive data from the export itself or alter its displayed content dynamically. While the scope is limited to files generated by the victim and opened locally, it poses significant risks regarding privacy leakage and potential manipulation of exported records for forensic or evidentiary purposes.
This vulnerability aligns with CWE-79, which classifies Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting (XSS). The attack vector corresponds to the Stored XSS technique found in the MITRE ATT&CK framework under T1059. Additionally, it reflects weaknesses in input validation and output encoding practices described by CWE-20 and CWE-83 respectively. To mitigate this risk, users must upgrade DiscordChatExporter to version 2.47.2 or later where the issue has been resolved through proper implementation of HTML entity encoding for all user-controlled inputs regardless of markdown settings. Developers integrating similar export functionalities should ensure that all dynamic content is strictly encoded before insertion into HTML templates and validate input sources against known malicious patterns.