CVE-2026-54682

DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, HTML exports generated with markdown formatting disabled pass attacker-controlled content through FormatMarkdownAsync and FormatEmbedMarkdownAsync in DiscordChatExporter.Core/Exporting/MessageGroupTemplate.cshtml and render it without HTML entity encoding. The affected fields include message.Content, message.ForwardedMessage.Content, message.ReferencedMessage.Content, embed.Title, embed.Description, field.Name, and field.Value. A Discord webhook or bot can store a script payload in these fields, and the payload executes when a user exports the channel with markdown formatting disabled and opens the resulting HTML, allowing the script to read the export or alter its displayed content. This issue is fixed in version 2.47.2.

• CWE-79

• https://github.com/Tyrrrz/DiscordChatExporter/commit/5632d6c3867d2f79cba9578056c98caee4377c1b
• https://github.com/Tyrrrz/DiscordChatExporter/pull/1545
• https://github.com/Tyrrrz/DiscordChatExporter/releases/tag/2.47.2
• https://github.com/Tyrrrz/DiscordChatExporter/security/advisories/GHSA-8qrv-mmch-fr9c
• https://github.com/Tyrrrz/DiscordChatExporter/security/advisories/GHSA-8qrv-mmch-fr9c

Published

Aug 21, 2026

Last Modified

Aug 25, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54676Scoold is a Q&A and a knowledge sharing platform for teams. …6.5
• CVE-2026-54677Scoold is a Q&A and a knowledge sharing platform for teams. …6.5
• CVE-2026-54679jq is a command-line JSON processor. Prior to 1.8.2, on 32bi…5.5
• CVE-2026-5468A security flaw has been discovered in Casdoor 2.356.0. This…5.4
• CVE-2026-54680Logging operator automates the deployment and configuration …9.9
• CVE-2026-54681DiscordChatExporter saves Discord chat logs to a file. Prior…4.1
• CVE-2026-54684jadx is a Dex to Java decompiler. From 1.5.2 to 1.5.5, a mal…7
• CVE-2026-54685FileBrowser Quantum is a free, self-hosted, web-based file m…5.3
• CVE-2026-54686Warp is an agentic development environment. From 0.2021.04.2…4.3
• CVE-2026-54687n8n-nodes-sqlite3 is a node for operating a local SQLite dat…9.8
• CVE-2026-54688mcp-searxng is a Model Context Protocol server that gives AI…6.5
• CVE-2026-54689mcp-searxng is a Model Context Protocol server that gives AI…6.3