Discordchatexporter
Monthly
Stored cross-site scripting in DiscordChatExporter prior to 2.47.2 allows a Discord bot or webhook operator to plant script payloads in message content or embed fields that execute in a victim's browser when the channel is exported with markdown formatting disabled. Affected fields include message body, forwarded and referenced message content, embed titles, descriptions, and field name/value pairs - all rendered without HTML entity encoding in the vulnerable code path. The issue is fixed in version 2.47.2, confirmed by GitHub security advisory GHSA-8qrv-mmch-fr9c; no public exploit code or active exploitation has been identified at time of analysis.
Stored XSS in DiscordChatExporter's HTML export engine allows script injection via maliciously crafted emoji metadata in chat logs prior to version 2.47.2. The VisitEmojiAsync method in HtmlMarkdownVisitor.cs interpolates emoji.Name into HTML alt attributes and emoji.Code into title attributes without HTML entity encoding, creating an injection point that executes in the victim's browser when they open the exported HTML file. Exploitation requires tampered offline input or a future relaxation of Discord's server-side emoji name validation; no public exploit or active exploitation has been identified at time of analysis.
Stored cross-site scripting in DiscordChatExporter prior to 2.47.2 allows a Discord bot or webhook operator to plant script payloads in message content or embed fields that execute in a victim's browser when the channel is exported with markdown formatting disabled. Affected fields include message body, forwarded and referenced message content, embed titles, descriptions, and field name/value pairs - all rendered without HTML entity encoding in the vulnerable code path. The issue is fixed in version 2.47.2, confirmed by GitHub security advisory GHSA-8qrv-mmch-fr9c; no public exploit code or active exploitation has been identified at time of analysis.
Stored XSS in DiscordChatExporter's HTML export engine allows script injection via maliciously crafted emoji metadata in chat logs prior to version 2.47.2. The VisitEmojiAsync method in HtmlMarkdownVisitor.cs interpolates emoji.Name into HTML alt attributes and emoji.Code into title attributes without HTML entity encoding, creating an injection point that executes in the victim's browser when they open the exported HTML file. Exploitation requires tampered offline input or a future relaxation of Discord's server-side emoji name validation; no public exploit or active exploitation has been identified at time of analysis.