CVE-2026-54682: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Tyrrrz DiscordChatExporter

DiscordChatExporter versions before 2.47.2 improperly neutralize input during web page generation when markdown formatting is disabled. Specifically, attacker-controlled content in message.Content, message.ForwardedMessage.Content, message.ReferencedMessage.Content, embed.Title, embed.Description, field.Name, and field.Value is passed through FormatMarkdownAsync and FormatEmbedMarkdownAsync without HTML entity encoding. This allows a Discord webhook or bot to inject script payloads that execute upon opening the exported HTML file, enabling reading or modification of the export. The vulnerability is addressed in version 2.47.2.

An attacker controlling a Discord webhook or bot can inject malicious scripts into exported chat logs. When a user exports a channel with markdown formatting disabled and opens the resulting HTML file, the script executes, potentially allowing the attacker to read the exported data or alter its displayed content. This compromises confidentiality and integrity of the exported chat logs. The vulnerability does not affect availability.

Upgrade DiscordChatExporter to version 2.47.2 or later, where this vulnerability is fixed. Users should avoid using versions prior to 2.47.2 for exporting Discord chat logs with markdown formatting disabled. No other mitigations are specified or required.