CVE-2026-54682

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54682
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54682.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54682
Aliases
  • GHSA-8qrv-mmch-fr9c
Published
2026-08-21T18:40:05.196Z
Modified
2026-08-23T03:53:39.074825458Z
Severity
  • 8.2 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N CVSS Calculator
Summary
DiscordChatExporter: Stored XSS in HTML export when markdown formatting is disabled
Details

DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, HTML exports generated with markdown formatting disabled pass attacker-controlled content through FormatMarkdownAsync and FormatEmbedMarkdownAsync in DiscordChatExporter.Core/Exporting/MessageGroupTemplate.cshtml and render it without HTML entity encoding. The affected fields include message.Content, message.ForwardedMessage.Content, message.ReferencedMessage.Content, embed.Title, embed.Description, field.Name, and field.Value. A Discord webhook or bot can store a script payload in these fields, and the payload executes when a user exports the channel with markdown formatting disabled and opens the resulting HTML, allowing the script to read the export or alter its displayed content. This issue is fixed in version 2.47.2.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54682.json"
}
References

Affected packages

Git / github.com/tyrrrz/discordchatexporter

Affected ranges

Type
GIT
Repo
https://github.com/tyrrrz/discordchatexporter
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
5632d6c3867d2f79cba9578056c98caee4377c1b
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.47.2"
        }
    ]
}

Affected versions

1.*
1.0.0
2.*
2.0.0
2.1.0
2.10
2.10.1
2.10.2
2.11
2.12
2.12.1
2.13
2.13.1
2.14
2.15
2.16
2.17
2.18
2.19
2.2.0
2.2.1
2.20
2.21
2.21.1
2.21.2
2.22
2.23
2.24
2.25
2.26
2.26.1
2.27
2.27.1
2.28
2.29
2.3
2.30
2.30.1
2.31
2.31.1
2.32
2.33
2.33.1
2.33.2
2.34
2.34.1
2.35
2.35.1
2.35.2
2.36
2.36.1
2.36.2
2.36.3
2.36.4
2.37
2.37.1
2.37.2
2.38
2.39
2.39.1
2.4
2.4.1
2.40
2.40.1
2.40.2
2.40.3
2.40.4
2.41
2.41.1
2.41.2
2.42
2.42.1
2.42.2
2.42.3
2.42.4
2.42.5
2.42.6
2.42.7
2.42.8
2.42.9
2.43
2.43.1
2.43.2
2.43.3
2.44
2.44.1
2.44.2
2.45
2.46
2.46.1
2.47
2.47.1
2.5
2.5.1
2.6
2.7
2.8
2.9
2.9.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54682.json"