CyberRota Analysis
AI-GeneratedDiscordChatExporter versions prior to 2.47.2 are vulnerable to a cross-site scripting (XSS) attack due to improper handling of user-controlled content in HTML exports when markdown formatting is disabled. An attacker can exploit this vulnerability by embedding a script payload in message fields, which executes upon export and can compromise the integrity of the exported chat logs. Organizations using DiscordChatExporter should prioritize upgrading to version 2.47.2 to mitigate the risk of unauthorized script execution and potential data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, HTML exports generated with markdown formatting disabled pass attacker-controlled content through FormatMarkdownAsync and FormatEmbedMarkdownAsync in DiscordChatExporter.Core/Exporting/MessageGroupTemplate.cshtml and render it without HTML entity encoding. The affected fields include message.Content, message.ForwardedMessage.Content, message.ReferencedMessage.Content, embed.Title, embed.Description, field.Name, and field.Value. A Discord webhook or bot can store a script payload in these fields, and the payload executes when a user exports the channel with markdown formatting disabled and opens the resulting HTML, allowing the script to read the export or alter its displayed content. This issue is fixed in version 2.47.2.