Description

DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, HTML exports generated with markdown formatting disabled pass attacker-controlled content through FormatMarkdownAsync and FormatEmbedMarkdownAsync in DiscordChatExporter.Core/Exporting/MessageGroupTemplate.cshtml and render it without HTML entity encoding. The affected fields include message.Content, message.ForwardedMessage.Content, message.ReferencedMessage.Content, embed.Title, embed.Description, field.Name, and field.Value. A Discord webhook or bot can store a script payload in these fields, and the payload executes when a user exports the channel with markdown formatting disabled and opens the resulting HTML, allowing the script to read the export or alter its displayed content. This issue is fixed in version 2.47.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-21T19:17:03.610Z",
  "pubdate": "2026-08-21T19:17:03.610Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists in DiscordChatExporter prior to version 2.47.2, specifically within the HTML export functionality when markdown formatting is disabled.\nThe vulnerability allows an attacker who controls a Discord webhook or bot to inject malicious script payloads into specific message and embed fields.\nWhen a victim exports the affected Discord channel with markdown formatting disabled and subsequently opens the generated HTML export in a browser, the embedded script executes within the context of the local file.\nThis successful exploitation enables the execution of arbitrary JavaScript, granting the attacker the capability to read sensitive contents within the export file or alter the displayed content to the user.\nThe risk implication is primarily client-side data exposure and UI manipulation arising from locally rendered untrusted input.\nExploitation requires the attacker to successfully inject payloads into Discord messages or embeds via a webhook or bot, and requires user interaction in the form of exporting the channel and opening the resulting HTML file with specific configuration settings.",
  "technicalDetails": "The root cause of the vulnerability is the failure to properly apply HTML entity encoding to attacker-controlled content before rendering it in HTML exports when markdown formatting is disabled.\nThe vulnerable components are located in DiscordChatExporter.Core/Exporting/MessageGroupTemplate.cshtml, specifically within the FormatMarkdownAsync and FormatEmbedMarkdownAsync functions.\nThe affected fields susceptible to injection include message.Content, message.ForwardedMessage.Content, message.ReferencedMessage.Content, embed.Title, embed.Description, field.Name, and field.Value.\nAffected software versions include all iterations of DiscordChatExporter prior to version 2.47.2.\nNo traditional network exposure or authentication requirements apply to the exploitation phase within the target application itself, as the payload vector relies on pre-existing data fetched from Discord via a bot or webhook.\nThe step-by-step attack flow proceeds as follows: First, an attacker utilizes a Discord webhook or bot to inject a crafted script payload into one or more of the vulnerable fields, such as a message content or an embed description.\nSecond, a target user initiates an export of the compromised Discord channel using DiscordChatExporter.\nThird, the user configures the export settings to have markdown formatting disabled.\nFourth, the application processes the chat logs, passing the malicious strings through FormatMarkdownAsync and FormatEmbedMarkdownAsync without performing necessary HTML entity encoding.\nFifth, the unescaped script payload is written directly into the generated HTML output file.\nSixth, when the user opens the resulting HTML file in a web browser, the browser interprets the payload as executable JavaScript rather than plain text.\nUpon execution, the payload behavior allows the script to interact with the DOM of the exported document, facilitating post-exploitation impacts such as reading the contents of the chat export or altering the displayed interface to deceive the user."
}