CVE-2026-54682 is an XSS in DiscordChatExporter's HTML export where disabling markdown formatting bypasses HTML encoding entirely, allowing stored scripts to execute when the exported file is opened. The vulnerability isn't really about the XSS itself — it's about where the encoding decision was placed in the code's abstraction layer. The tool treated HTML encoding as implicitly tied to markdown processing: when markdown was disabled, the code assumed it was handling 'plain text' and skipped encoding. But in an HTML export context, there is no plain text — any user-supplied content rendered into HTML requires entity encoding regardless of formatting options.
The practical attack path requires a compromised or malicious Discord webhook to plant the payload, which then executes when someone opens the exported HTML. This inverts the typical XSS model: the defender runs the export, and their own defensive archival action becomes the delivery mechanism. The person clicking 'export' is also the potential victim.
The temporal dimension is what makes this serious beyond the immediate patch. Every export generated with markdown disabled before version 2.47.2 remains potentially vulnerable — those files sit on hard drives, in cloud storage, in email attachments, indefinitely. A payload planted in 2023 still fires in 2030 when someone opens the file. This is a fossilized exploit with unbounded shelf life.
Treat Discord as an untrusted content source for export purposes. The fix in 2.47.2 closes the specific code path, but verify the patch actually decouples encoding from formatting toggles entirely rather than just re-enabling a disabled call. If encoding remains conditional on a formatting option, the same abstraction failure persists in other paths. Review any other export formats (JSON, CSV, markdown files) for the same pattern — where the output medium's parsing behavior wasn't treated as a first-class security boundary.