CyberRota Analysis
AI-GeneratedDiscordChatExporter versions prior to 2.47.2 are vulnerable due to improper HTML entity encoding in the VisitEmojiAsync method, which can lead to potential HTML injection attacks when exporting chat logs. This vulnerability allows for the injection of malicious scripts via tampered emoji names, posing a risk when users open the exported files. Organizations using DiscordChatExporter should prioritize updating to version 2.47.2 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, the VisitEmojiAsync method in DiscordChatExporter.Core/Exporting/HtmlMarkdownVisitor.cs interpolates emoji.Name into the alt attribute and emoji.Code into the title attribute without HTML entity encoding. This affects HTML exports regardless of the markdown setting. Discord's current custom emoji name validation normally excludes attribute-breaking characters, but tampered offline input, a relaxed upstream validation rule, or another future metadata source can inject an HTML attribute and execute script when a user opens the export. This issue is fixed in version 2.47.2.