Executive brief
Telegram Desktop's HTML chat export feature fails to properly escape text in inline keyboard buttons, allowing attackers to plant hidden JavaScript that executes when a user opens the exported file. An attacker's bot can send a single message with malicious code in a button—this message can be forwarded into any group by anyone, then sit dormant in chat history for months until a participant exports and opens the HTML file. When triggered, the JavaScript can steal all messages and metadata from that export or completely rewrite the page shown to the user.
Technical details
A stored XSS vulnerability in export_output_html.cpp where button text is written to HTML without sanitization via SerializeString(). The attack requires no write access to the target chat—a bot outside the group can send a message to any chat, and forwarding into the target group is sufficient. The payload persists invisibly in message history and executes only when a chat participant uses the HTML export feature and opens the resulting file in a browser, giving an attacker read access to all exported content and DOM control.
Affected products
- Telegram Desktop before 6.9.4 (Beta) / before 7.0.1 (Stable)
Timeline
- 2026-09-21: disclosed: CVE-2026-94488 assigned; advisory published
- 2026-07: patched: Fix shipped in Beta v6.9.4 and Stable v7.0.1
- 2026-06-03: other: Vulnerability reported to vendor