CVE-2026-54682: DiscordChatExporter XSS Vulnerability

CVE-2026-54682 Overview

CVE-2026-54682 is a stored cross-site scripting (XSS) vulnerability in DiscordChatExporter, a tool that saves Discord chat logs to a file. Versions prior to 2.47.2 render attacker-controlled content without HTML entity encoding when users generate HTML exports with markdown formatting disabled. A Discord webhook or bot can plant a script payload in message or embed fields. The payload executes when a victim opens the resulting HTML export in a browser. The classification maps to [CWE-79] Improper Neutralization of Input During Web Page Generation. The maintainer fixed the issue in release 2.47.2.

Critical Impact
An attacker-controlled Discord message or embed can execute arbitrary JavaScript inside a victim's exported HTML file, allowing the script to read the exported chat contents or manipulate what the reader sees.

Affected Products

DiscordChatExporter versions prior to 2.47.2
HTML export mode with markdown formatting disabled
DiscordChatExporter.Core/Exporting/MessageGroupTemplate.cshtml rendering path

Discovery Timeline

2026-08-21 - CVE-2026-54682 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-54682

Vulnerability Analysis

DiscordChatExporter renders chat logs to HTML using Razor templates. When a user disables markdown formatting during export, the affected templates route content through FormatMarkdownAsync and FormatEmbedMarkdownAsync in DiscordChatExporter.Core/Exporting/MessageGroupTemplate.cshtml without applying HTML entity encoding. The unsanitized fields include message.Content, message.ForwardedMessage.Content, message.ReferencedMessage.Content, embed.Title, embed.Description, field.Name, and field.Value. An attacker who controls a Discord webhook or bot can post a payload containing <script> tags or event handlers. The payload persists in Discord's message history until a victim exports the channel. Rendering the export file in a browser executes the script in the file's origin context.

Root Cause

The root cause is missing output encoding on the code path that handles the markdown-disabled formatting mode. The formatting helpers assumed callers would sanitize input, but the templates emitted raw strings directly into the HTML document. Razor's automatic encoding was bypassed because the templates used raw output for message content.

Attack Vector

Exploitation requires an attacker to inject content into a Discord channel that the victim later exports. The victim must run DiscordChatExporter with markdown formatting disabled and open the resulting HTML file. Because the exported file typically lives on the local filesystem, script execution occurs in a file:// origin, granting access to the exported chat data and DOM.

text

// Patch context from PreambleTemplate.cshtml (v2.47.2)
 @using System
 @using System.Threading.Tasks
+@using RazorBlade
 
 @inherits RazorBlade.HtmlTemplate
// Source: https://github.com/Tyrrrz/DiscordChatExporter/commit/5632d6c3867d2f79cba9578056c98caee4377c1b

The committed fix introduces RazorBlade.HtmlTemplate inheritance and HTML-encodes markdown content when formatting is disabled, closing the injection sink.

Detection Methods for CVE-2026-54682

Indicators of Compromise

Exported HTML files containing <script> tags, on* event handler attributes, or javascript: URIs inside message content or embed fields.
Discord messages authored by webhooks or bots that include raw HTML tags or unusual character sequences resembling script payloads.
Browser console errors or unexpected network requests generated when opening a DiscordChatExporter HTML export.

Detection Strategies

Scan generated HTML exports for markup patterns inside message content nodes using static analysis or grep-style rules for <script, onerror=, and onload= tokens.
Compare the installed DiscordChatExporter binary version against the fixed release 2.47.2 across engineering and analyst workstations.
Review Discord audit logs for webhook and bot messages containing angle brackets or HTML entities in short, targeted message bursts.

Monitoring Recommendations

Alert on execution of DiscordChatExporter.Cli or DiscordChatExporter.Gui from unmanaged endpoints or with --markdown false style parameters.
Monitor browsers rendering file:// URIs that point to .html outputs produced by the tool for outbound network connections.
Track process ancestry where a browser child process is launched from a DiscordChatExporter output directory.

How to Mitigate CVE-2026-54682

Immediate Actions Required

Upgrade DiscordChatExporter to version 2.47.2 or later on every workstation that performs channel exports.
Re-export any previously generated HTML archives that were produced with markdown formatting disabled, or open them only in an isolated, non-network browser context.
Restrict which webhooks and bots can post to sensitive Discord channels and rotate tokens for any untrusted integrations.

Patch Information

The fix is in GitHub Release v2.47.2, delivered via GitHub Pull Request #1545 and commit 5632d6c. Full details are documented in GitHub Security Advisory GHSA-8qrv-mmch-fr9c.

Workarounds

Export chats using a non-HTML format such as JSON, CSV, or plain text until the upgrade is complete.
If HTML export is required, keep markdown formatting enabled to avoid the vulnerable code path.
Open exported HTML files only in a sandboxed browser profile with JavaScript disabled.

bash

# Verify the installed version is patched
DiscordChatExporter.Cli --version

# Safer export format while remediating
DiscordChatExporter.Cli export -t <TOKEN> -c <CHANNEL_ID> -f Json