EUVD-2026-64048Severity by source
AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Local vector because exploitation requires tampered local input files; AC:H reflects the precondition that Discord's current validation must be bypassed; S:C for browser script execution crossing the security boundary.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, the VisitEmojiAsync method in DiscordChatExporter.Core/Exporting/HtmlMarkdownVisitor.cs interpolates emoji.Name into the alt attribute and emoji.Code into the title attribute without HTML entity encoding. This affects HTML exports regardless of the markdown setting. Discord's current custom emoji name validation normally excludes attribute-breaking characters, but tampered offline input, a relaxed upstream validation rule, or another future metadata source can inject an HTML attribute and execute script when a user opens the export. This issue is fixed in version 2.47.2.
AnalysisAI
Stored XSS in DiscordChatExporter's HTML export engine allows script injection via maliciously crafted emoji metadata in chat logs prior to version 2.47.2. The VisitEmojiAsync method in HtmlMarkdownVisitor.cs interpolates emoji.Name into HTML alt attributes and emoji.Code into title attributes without HTML entity encoding, creating an injection point that executes in the victim's browser when they open the exported HTML file. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that a victim use DiscordChatExporter prior to 2.47.2 to generate an HTML export from input containing emoji with attribute-breaking characters in their Name or Code fields. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 score of 4.1 with vector AV:L/AC:H/PR:N/UI:R/S:C reflects the constrained real-world attack path accurately. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to DiscordChatExporter version 2.47.2 or later, available at https://github.com/Tyrrrz/DiscordChatExporter/releases/tag/2.47.2. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Discordchatexporter
View allSame weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today