Description

Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. (The first fixed stable version is 7.0.1.) This occurs in button.text.toUtf8 in export_output_html.cpp. Exploitation cannot occur unless HTML export was used by a victim. However, the exploit payload can be exported if a message were forwarded into a group by a member (it is not necessary for the message author to be a member of a group).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-09-21T18:17:17.173Z",
  "pubdate": "2026-09-21T18:17:17.173Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists within the HTML export functionality of Telegram Desktop prior to version 6.9.4. The vulnerability stems from improper neutralization of user-supplied input during the export process, specifically within the button.text.toUtf8 function.\nThe vulnerability allows an attacker to inject malicious scripts into exported HTML files. While execution requires the victim to perform an export action, the exploit vector is highly accessible via message forwarding. If a malicious message is forwarded into a group, it can be captured in an export performed by any member of that group, regardless of the attacker's membership status.\nSuccessful exploitation results in the execution of arbitrary JavaScript within the context of the locally generated HTML file, potentially leading to unauthorized data access or local system interaction if the generated report is viewed in a browser environment. The risk is constrained to the exported artifact, but poses a significant threat to information integrity and local machine security if users rely on these exports for archival or forensic purposes.",
  "technicalDetails": "The vulnerability is located in the export_output_html.cpp file within the Telegram Desktop source code. The root cause is identified as an insufficient sanitization process within the button.text.toUtf8 function. This function fails to correctly encode or escape user-controlled string inputs before they are embedded into the generated HTML structure during the data export process.\nThe attack flow begins when an attacker crafts a message containing a malicious payload designed to escape the expected HTML context. This payload is then forwarded into a group or channel. The payload does not require the attacker to be a direct participant in the group, as the forwarded message carries the malicious content through Telegram's infrastructure.\nA victim, who is a member of the targeted group, initiates the Telegram data export feature. Telegram Desktop processes the messages—including the attacker's forwarded payload—and serializes them into an HTML output file. During this serialization, the vulnerable button.text.toUtf8 function processes the payload without applying proper XSS prevention measures. Consequently, the script tags or event handlers included in the payload are written into the final HTML file as active, unescaped code.\nUpon opening the exported HTML file in a web browser, the browser interprets the malicious script as legitimate content belonging to the document. This results in the execution of the attacker's code within the victim's local browser environment. The exploitation impact is scoped by the browser's security model, though it may allow the execution of unauthorized scripts that could interact with local file resources or exfiltrate contents of the exported archive if the victim views the file under permissive security settings.\nThe vulnerability affects all versions of Telegram Desktop prior to 6.9.4. The issue was addressed in version 7.0.1, which serves as the first stable fixed release. The primary prerequisite for exploitation is the victim's manual initiation of the HTML export functionality, making this an indirect attack vector that leverages a trusted tool to compromise the user's local reporting environment."
}