CVE-2026-54682

Name of the Vulnerable Software and Affected Versions DiscordChatExporter versions prior to 2.47.2

Description HTML exports generated with markdown formatting disabled fail to perform HTML entity encoding on attacker-controlled content processed by the FormatMarkdownAsync and FormatEmbedMarkdownAsync functions within DiscordChatExporter.Core/Exporting/MessageGroupTemplate.cshtml. This allows a Discord webhook or bot to store a script payload in the message.Content, message.ForwardedMessage.Content, message.ReferencedMessage.Content, embed.Title, embed.Description, field.Name, and field.Value fields. The script executes when a user opens the resulting HTML file, enabling the script to read the export or modify its displayed content.

Recommendations Update to version 2.47.2.