EUVD-2026-64047Severity by source
AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
AV:L because payload fires when a local HTML file is opened; PR:N because the attacker needs no privileges on the victim system, only Discord posting access; S:C because script crosses into browser context.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, HTML exports generated with markdown formatting disabled pass attacker-controlled content through FormatMarkdownAsync and FormatEmbedMarkdownAsync in DiscordChatExporter.Core/Exporting/MessageGroupTemplate.cshtml and render it without HTML entity encoding. The affected fields include message.Content, message.ForwardedMessage.Content, message.ReferencedMessage.Content, embed.Title, embed.Description, field.Name, and field.Value. A Discord webhook or bot can store a script payload in these fields, and the payload executes when a user exports the channel with markdown formatting disabled and opens the resulting HTML, allowing the script to read the export or alter its displayed content. This issue is fixed in version 2.47.2.
AnalysisAI
Stored cross-site scripting in DiscordChatExporter prior to 2.47.2 allows a Discord bot or webhook operator to plant script payloads in message content or embed fields that execute in a victim's browser when the channel is exported with markdown formatting disabled. Affected fields include message body, forwarded and referenced message content, embed titles, descriptions, and field name/value pairs - all rendered without HTML entity encoding in the vulnerable code path. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three specific conditions must all be met: (1) the attacker must control a Discord bot or webhook with the ability to post messages or populate embed fields in the target channel; (2) the victim must export that channel using DiscordChatExporter with the markdown formatting option explicitly disabled - the markdown-enabled export path routes through HtmlMarkdownVisitor which performs its own encoding and is not affected by this flaw; (3) the victim must open the resulting HTML export file in a web browser. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.2 score reflects the scope change and dual C:H/I:H impact, but the real-world attack surface is substantially narrowed by the exploitation conditions: the victim must both use the markdown-disabled export mode and open the resulting HTML file in a browser. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to DiscordChatExporter 2.47.2 or later, available at https://github.com/Tyrrrz/DiscordChatExporter/releases/tag/2.47.2; the fix is confirmed by commit 5632d6c3867d2f79cba9578056c98caee4377c1b and PR #1545. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running DiscordChatExporter and immediately restrict access to exported channel files to authorized personnel only; audit and disable unused Discord bot and webhook integrations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Discordchatexporter
View allSame weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today