DiscordChatExporter allows malicious script code to be stored in several message fields such as message content, forwarded and referenced message content, embed title and description, and field names and values. When the exporter is instructed to produce an HTML file with markdown formatting turned off, these fields are rendered without HTML entity encoding. An attacker can supply forged text through a Discord webhook or bot that contains embedded JavaScript. After the vulnerable exporter writes the content to the HTML file, a local user who opens that file in a web browser triggers the execution of the script, enabling the attacker to read or modify the exported chat data through the page’s DOM.

The issue affects all releases of Tyrrrz:DiscordChatExporter up to, but not including, version 2.47.2. Users running any earlier version and exporting with markdown disabled are exposed until they apply the update or change their export settings.

The CVSS score of 8.2 categorizes this vulnerability as high severity. No EPSS score is provided, and it is not listed in the CISA KEV catalog. The attack requires the victim to locally open the generated HTML file, making it a local stored XSS that can be exploited by an attacker controlling webhook or bot content. Successful exploitation grants the attacker the ability to read or alter the displayed chat export content.