CVE-2026-54681

DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, the VisitEmojiAsync method in DiscordChatExporter.Core/Exporting/HtmlMarkdownVisitor.cs interpolates emoji.Name into the alt attribute and emoji.Code into the title attribute without HTML entity encoding. This affects HTML exports regardless of the markdown setting. Discord's current custom emoji name validation normally excludes attribute-breaking characters, but tampered offline input, a relaxed upstream validation rule, or another future metadata source can inject an HTML attribute and execute script when a user opens the export. This issue is fixed in version 2.47.2.

• CWE-79

• https://github.com/Tyrrrz/DiscordChatExporter/commit/f4d1e630f7f27120c3be4320d92cc8b932e78688
• https://github.com/Tyrrrz/DiscordChatExporter/pull/1544
• https://github.com/Tyrrrz/DiscordChatExporter/releases/tag/2.47.2
• https://github.com/Tyrrrz/DiscordChatExporter/security/advisories/GHSA-r7qm-wg9p-pjfc
• https://github.com/Tyrrrz/DiscordChatExporter/security/advisories/GHSA-r7qm-wg9p-pjfc

Published

Aug 21, 2026

Last Modified

Aug 21, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54673electron-updater allows for automatic updates for Electron a…6.5
• CVE-2026-54676Scoold is a Q&A and a knowledge sharing platform for teams. …6.5
• CVE-2026-54677Scoold is a Q&A and a knowledge sharing platform for teams. …6.5
• CVE-2026-54679jq is a command-line JSON processor. Prior to 1.8.2, on 32bi…5.5
• CVE-2026-5468A security flaw has been discovered in Casdoor 2.356.0. This…5.4
• CVE-2026-54680Logging operator automates the deployment and configuration …9.9
• CVE-2026-54682DiscordChatExporter saves Discord chat logs to a file. Prior…8.2
• CVE-2026-54684jadx is a Dex to Java decompiler. From 1.5.2 to 1.5.5, a mal…7
• CVE-2026-54685FileBrowser Quantum is a free, self-hosted, web-based file m…5.3
• CVE-2026-54686Warp is an agentic development environment. From 0.2021.04.2…4.3
• CVE-2026-54687n8n-nodes-sqlite3 is a node for operating a local SQLite dat…9.8
• CVE-2026-54688mcp-searxng is a Model Context Protocol server that gives AI…6.5