CVE-2026-54681: DiscordChatExporter XSS Vulnerability

CVE-2026-54681 Overview

CVE-2026-54681 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in DiscordChatExporter, a utility that saves Discord chat logs to disk. The VisitEmojiAsync method in DiscordChatExporter.Core/Exporting/HtmlMarkdownVisitor.cs interpolates emoji.Name and emoji.Code into HTML alt and title attributes without HTML entity encoding. When a user opens the resulting HTML export, an attacker-controlled emoji field can break out of the attribute context and execute JavaScript in the local browser origin. The issue affects all HTML exports regardless of the markdown setting and is fixed in version 2.47.2.

Critical Impact
An attacker who controls emoji metadata (through tampered offline input, relaxed upstream validation, or a future metadata source) can inject arbitrary HTML attributes and execute script when a victim opens the exported chat log.

Affected Products

DiscordChatExporter versions prior to 2.47.2
HTML export format produced by HtmlMarkdownVisitor.cs
Any downstream consumer of DiscordChatExporter HTML output

Discovery Timeline

2026-08-21 - CVE-2026-54681 published to NVD
2026-08-21 - Last updated in NVD database

Technical Details for CVE-2026-54681

Vulnerability Analysis

The flaw is a classic HTML attribute injection leading to stored XSS. The exporter builds an <img> tag for custom emojis by string-interpolating the emoji Name value into the alt attribute and the emoji Code value into the title attribute. Because neither value passes through an HTML entity encoder, a payload containing a quote character can terminate the attribute and introduce a new attribute such as onerror or onload. The injected event handler then executes when the victim opens the saved HTML file in a browser.

Discord's server-side validation for custom emoji names currently rejects attribute-breaking characters, so the vulnerability is not directly reachable from the live Discord API. Reachability depends on tampered offline JSON input passed to the exporter, a relaxed upstream validation rule, or a new metadata field feeding the same code path.

Root Cause

The exporter relies on upstream input sanitization instead of context-aware output encoding. Values flowing into HTML attribute contexts must be encoded with HtmlEncode before interpolation. The fix in commit f4d1e630f7f27120c3be4320d92cc8b932e78688 applies HtmlEncode to several attribute sinks in HtmlMarkdownVisitor.cs, including the code-block language attribute and emoji attributes.

Attack Vector

Exploitation requires local access to a manipulated export input and user interaction to open the resulting HTML file. An attacker crafts an emoji Name or Code field containing " followed by an event handler, feeds it to DiscordChatExporter (for example by tampering with an offline dataset), and delivers the generated HTML to the victim.

diff

// Patch excerpt from HtmlMarkdownVisitor.cs (commit f4d1e630)
     )
     {
         var highlightClass = !string.IsNullOrWhiteSpace(multiLineCodeBlock.Language)
-            ? $"language-{multiLineCodeBlock.Language}"
+            ? $"language-{HtmlEncode(multiLineCodeBlock.Language)}"
             : "nohighlight";

         buffer.Append(

Source: GitHub Commit f4d1e630

Detection Methods for CVE-2026-54681

Indicators of Compromise

Exported HTML files containing <img tags whose alt or title attributes include unescaped quote characters, onerror=, onload=, or <script fragments.
Presence of DiscordChatExporter binaries with versions earlier than 2.47.2 in build pipelines or analyst workstations.
Offline Discord JSON archives sourced from untrusted third parties prior to conversion.

Detection Strategies

Scan generated HTML exports for attribute-injection patterns using regular expressions targeting alt="[^"]*"[^>]*on\w+= and similar constructs.
Inventory endpoints for DiscordChatExporter.exe or the CLI binary and compare reported versions against 2.47.2.
Review process-creation telemetry for DiscordChatExporter invocations that consume JSON files from untrusted paths.

Monitoring Recommendations

Alert on browser processes loading local HTML files that originated from chat-export workflows, particularly when they spawn child processes or initiate outbound connections.
Track file writes of .html artifacts by DiscordChatExporter and correlate with subsequent user-initiated opens.
Log and review any DiscordChatExporter usage inside investigation or DFIR environments where tampered inputs are plausible.

How to Mitigate CVE-2026-54681

Immediate Actions Required

Upgrade DiscordChatExporter to version 2.47.2 or later on all systems that generate or consume Discord chat exports.
Re-generate any HTML exports produced by vulnerable versions from trusted source data before sharing them further.
Treat existing exports from unknown provenance as untrusted and open them only in sandboxed browsers or virtual machines.

Patch Information

The fix is delivered in DiscordChatExporter release 2.47.2 via Pull Request #1544 and commit f4d1e630. Details are documented in GitHub Security Advisory GHSA-r7qm-wg9p-pjfc.

Workarounds

Export to non-HTML formats (JSON, plain text, or CSV) until the patched version is deployed.
Validate emoji Name and Code fields in offline JSON inputs to strip quote characters and angle brackets before running the exporter.
Open exported HTML files only in browsers configured with strict Content Security Policy for local files, or convert them to PDF before distribution.

bash

# Verify installed version and upgrade
dotnet tool update -g DiscordChatExporter.Cli --version 2.47.2
DiscordChatExporter.Cli --version   # expect 2.47.2 or later