---
id: CVE-2026-54682
title: DiscordChatExporter saves Discord chat logs to a file
summary: >-
  DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, HTML
  exports generated with markdown formatting disabled pass attacker-controlled
  content through FormatMarkdownAsync and FormatEmbedMarkdownAsync in
  DiscordChatExpo…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N'
cwe:
  - CWE-79
published: '2026-08-21'
updated: '2026-09-30'
sourceUpdated: '2026-09-30T19:57:08.043'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54682'
references:
  - url: >-
      https://github.com/Tyrrrz/DiscordChatExporter/commit/5632d6c3867d2f79cba9578056c98caee4377c1b
    label: security-advisories@github.com
  - url: 'https://github.com/Tyrrrz/DiscordChatExporter/pull/1545'
    label: security-advisories@github.com
  - url: 'https://github.com/Tyrrrz/DiscordChatExporter/releases/tag/2.47.2'
    label: security-advisories@github.com
  - url: >-
      https://github.com/Tyrrrz/DiscordChatExporter/security/advisories/GHSA-8qrv-mmch-fr9c
    label: security-advisories@github.com
  - url: >-
      https://github.com/Tyrrrz/DiscordChatExporter/security/advisories/GHSA-8qrv-mmch-fr9c
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00197
epssPercentile: 0.08484
ingestedAt: '2026-09-30T20:23:19.467Z'
---

## Overview

DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, HTML exports generated with markdown formatting disabled pass attacker-controlled content through FormatMarkdownAsync and FormatEmbedMarkdownAsync in DiscordChatExporter.Core/Exporting/MessageGroupTemplate.cshtml and render it without HTML entity encoding. The affected fields include message.Content, message.ForwardedMessage.Content, message.ReferencedMessage.Content, embed.Title, embed.Description, field.Name, and field.Value. A Discord webhook or bot can store a script payload in these fields, and the payload executes when a user exports the channel with markdown formatting disabled and opens the resulting HTML, allowing the script to read the export or alter its displayed content. This issue is fixed in version 2.47.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.