CVE-2026-94488: XSS
Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. (The first fixed stable version is 7.0.1.) This occurs in button.text.toUtf8 in exportoutputhtml.cpp. Exploitation cannot occur unless HTML export was used by a victim. However, the exploit payload can be exported if a message were forwarded into a group by a member (it is not necessary for the message author to be a member of a group).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Telegram Desktopto a version that resolves this vulnerability.Fixed in 6.9.4
Event History
Frequently Asked Questions
Which users are exposed to this issue?
Exposure requires a victim to use Telegram Desktop's HTML export feature. Users who do not export chats to HTML cannot be exploited through this issue.
What must an attacker do to get a payload into an exported chat?
A malicious payload can be included in a message that is forwarded into a group by one of its members. The original message author does not need to be a member of that group.
Which version should be used to remediate the issue?
The issue affects versions before 6.9.4. The first fixed stable version is 7.0.1.