CVE-2026-54682

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54682", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-15T22:53:58.561Z", "datePublished": "2026-08-21T18:40:05.196Z", "dateUpdated": "2026-08-25T17:31:36.280Z"}, "containers": {"cna": {"title": "DiscordChatExporter: Stored XSS in HTML export when markdown formatting is disabled", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/Tyrrrz/DiscordChatExporter/security/advisories/GHSA-8qrv-mmch-fr9c", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Tyrrrz/DiscordChatExporter/security/advisories/GHSA-8qrv-mmch-fr9c"}, {"name": "https://github.com/Tyrrrz/DiscordChatExporter/pull/1545", "tags": ["x_refsource_MISC"], "url": "https://github.com/Tyrrrz/DiscordChatExporter/pull/1545"}, {"name": "https://github.com/Tyrrrz/DiscordChatExporter/commit/5632d6c3867d2f79cba9578056c98caee4377c1b", "tags": ["x_refsource_MISC"], "url": "https://github.com/Tyrrrz/DiscordChatExporter/commit/5632d6c3867d2f79cba9578056c98caee4377c1b"}, {"name": "https://github.com/Tyrrrz/DiscordChatExporter/releases/tag/2.47.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/Tyrrrz/DiscordChatExporter/releases/tag/2.47.2"}], "affected": [{"vendor": "Tyrrrz", "product": "DiscordChatExporter", "versions": [{"version": "< 2.47.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-21T18:40:05.196Z"}, "descriptions": [{"lang": "en", "value": "DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, HTML exports generated with markdown formatting disabled pass attacker-controlled content through FormatMarkdownAsync and FormatEmbedMarkdownAsync in DiscordChatExporter.Core/Exporting/MessageGroupTemplate.cshtml and render it without HTML entity encoding. The affected fields include message.Content, message.ForwardedMessage.Content, message.ReferencedMessage.Content, embed.Title, embed.Description, field.Name, and field.Value. A Discord webhook or bot can store a script payload in these fields, and the payload executes when a user exports the channel with markdown formatting disabled and opens the resulting HTML, allowing the script to read the export or alter its displayed content. This issue is fixed in version 2.47.2."}], "source": {"advisory": "GHSA-8qrv-mmch-fr9c", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/Tyrrrz/DiscordChatExporter/security/advisories/GHSA-8qrv-mmch-fr9c", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-25T17:30:13.704628Z", "id": "CVE-2026-54682", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T17:31:36.280Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-54682", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-25T17:30:13.704628Z"}}}], "references": [{"url": "https://github.com/Tyrrrz/DiscordChatExporter/security/advisories/GHSA-8qrv-mmch-fr9c", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T17:31:29.906Z"}}], "cna": {"title": "DiscordChatExporter: Stored XSS in HTML export when markdown formatting is disabled", "source": {"advisory": "GHSA-8qrv-mmch-fr9c", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Tyrrrz", "product": "DiscordChatExporter", "versions": [{"status": "affected", "version": "< 2.47.2"}]}], "references": [{"url": "https://github.com/Tyrrrz/DiscordChatExporter/security/advisories/GHSA-8qrv-mmch-fr9c", "name": "https://github.com/Tyrrrz/DiscordChatExporter/security/advisories/GHSA-8qrv-mmch-fr9c", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Tyrrrz/DiscordChatExporter/pull/1545", "name": "https://github.com/Tyrrrz/DiscordChatExporter/pull/1545", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/Tyrrrz/DiscordChatExporter/commit/5632d6c3867d2f79cba9578056c98caee4377c1b", "name": "https://github.com/Tyrrrz/DiscordChatExporter/commit/5632d6c3867d2f79cba9578056c98caee4377c1b", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/Tyrrrz/DiscordChatExporter/releases/tag/2.47.2", "name": "https://github.com/Tyrrrz/DiscordChatExporter/releases/tag/2.47.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, HTML exports generated with markdown formatting disabled pass attacker-controlled content through FormatMarkdownAsync and FormatEmbedMarkdownAsync in DiscordChatExporter.Core/Exporting/MessageGroupTemplate.cshtml and render it without HTML entity encoding. The affected fields include message.Content, message.ForwardedMessage.Content, message.ReferencedMessage.Content, embed.Title, embed.Description, field.Name, and field.Value. A Discord webhook or bot can store a script payload in these fields, and the payload executes when a user exports the channel with markdown formatting disabled and opens the resulting HTML, allowing the script to read the export or alter its displayed content. This issue is fixed in version 2.47.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-21T18:40:05.196Z"}}}, "cveMetadata": {"cveId": "CVE-2026-54682", "state": "PUBLISHED", "dateUpdated": "2026-08-25T17:31:36.280Z", "dateReserved": "2026-06-15T22:53:58.561Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-21T18:40:05.196Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "DiscordChatExporter", "vendor": "Tyrrrz", "versions": [{"status": "affected", "version": "< 2.47.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, HTML exports generated with markdown formatting disabled pass attacker-controlled content through FormatMarkdownAsync and FormatEmbedMarkdownAsync in DiscordChatExporter.Core/Exporting/MessageGroupTemplate.cshtml and render it without HTML entity encoding. The affected fields include message.Content, message.ForwardedMessage.Content, message.ReferencedMessage.Content, embed.Title, embed.Description, field.Name, and field.Value. A Discord webhook or bot can store a script payload in these fields, and the payload executes when a user exports the channel with markdown formatting disabled and opens the resulting HTML, allowing the script to read the export or alter its displayed content. This issue is fixed in version 2.47.2."}, {"lang": "es", "value": "DiscordChatExporter guarda los registros de chat de Discord en un archivo. Antes de la versi\u00f3n 2.47.2, las exportaciones HTML generadas con el formato markdown deshabilitado pasan contenido controlado por el atacante a trav\u00e9s de FormatMarkdownAsync y FormatEmbedMarkdownAsync en DiscordChatExporter.Core/Exporting/MessageGroupTemplate.cshtml y lo renderizan sin codificaci\u00f3n de entidades HTML. Los campos afectados incluyen message.Content, message.ForwardedMessage.Content, message.ReferencedMessage.Content, embed.Title, embed.Description, field.Name y field.Value. Un webhook o bot de Discord puede almacenar una carga \u00fatil de script en estos campos, y la carga \u00fatil se ejecuta cuando un usuario exporta el canal con el formato markdown deshabilitado y abre el HTML resultante, permitiendo que el script lea la exportaci\u00f3n o altere su contenido mostrado. Este problema est\u00e1 solucionado en la versi\u00f3n 2.47.2."}], "id": "CVE-2026-54682", "lastModified": "2026-10-14T19:10:00.297", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.8, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54682", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-25T17:30:13.704628Z", "version": "2.0.3"}}]}, "published": "2026-08-21T19:17:03.610", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/Tyrrrz/DiscordChatExporter/commit/5632d6c3867d2f79cba9578056c98caee4377c1b"}, {"source": "security-advisories@github.com", "url": "https://github.com/Tyrrrz/DiscordChatExporter/pull/1545"}, {"source": "security-advisories@github.com", "url": "https://github.com/Tyrrrz/DiscordChatExporter/releases/tag/2.47.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/Tyrrrz/DiscordChatExporter/security/advisories/GHSA-8qrv-mmch-fr9c"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/Tyrrrz/DiscordChatExporter/security/advisories/GHSA-8qrv-mmch-fr9c"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.47.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "DiscordChatExporter", "source": "cna", "vendor": "Tyrrrz"}, "product": "discordchatexporter", "vendor": "tyrrrz"}], "created": "2026-08-21T21:00:03.525659+00:00", "updated": "2026-08-21T21:14:58.646821+00:00", "vendors": ["tyrrrz", "tyrrrz$PRODUCT$discordchatexporter"]}