Executive brief
DiscordChatExporter is a tool that exports Discord chat conversations to HTML files. When users export chats with markdown formatting disabled, the application fails to properly escape HTML content, allowing attackers to inject malicious JavaScript code through Discord messages, embeds, or webhook content. When the exported HTML file is opened in a browser, the injected script executes, potentially stealing chat data or manipulating the displayed content.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in DiscordChatExporter's HTML export functionality. The vulnerability exists in MessageGroupTemplate.cshtml, where the FormatMarkdownAsync and FormatEmbedMarkdownAsync methods fail to HTML-encode user-controlled content when markdown formatting is disabled. Vulnerable fields include message.Content, message.ForwardedMessage.Content, message.ReferencedMessage.Content, embed.Title, embed.Description, and field.Name/Value. An attacker can craft a Discord message or embed containing JavaScript payloads (e.g., via a bot or webhook), which are stored in Discord. When a user exports the channel with markdown formatting disabled and opens the resulting HTML file in a browser, the unencode script executes in the context of the local file. The fix, released in version 2.47.2, adds proper HTML entity encoding to prevent script injection.
Affected products
- Tyrrrz DiscordChatExporter before 2.47.2
Timeline
- 2026-08-21: disclosed
- 2026-06-04: patched: Fix committed and merged in version 2.47.2