Description
DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, the VisitEmojiAsync method in DiscordChatExporter.Core/Exporting/HtmlMarkdownVisitor.cs interpolates emoji.Name into the alt attribute and emoji.Code into the title attribute without HTML entity encoding. This affects HTML exports regardless of the markdown setting. Discord-s current custom emoji name validation normally excludes attribute-breaking characters, but tampered offline input, a relaxed upstream validation rule, or another future metadata source can inject an HTML attribute and execute script when a user opens the export. This issue is fixed in version 2.47.2.
CVSS 4.1EPSS 0.125%Risque 0.41
Voir la source- Publication
- 2026-08-21 19:17:03
- Versions concernées
- <2.47.2
- Type
- Bibliothèque
- Dernière modification
- 2026-08-21 20:16:37
- Vecteur
- CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N