CVE-2026-94488 in Telegram
Summary
by MITRE • 09/21/2026
Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. (The first fixed stable version is 7.0.1.) This occurs in button.text.toUtf8 in export_output_html.cpp. Exploitation cannot occur unless HTML export was used by a victim. However, the exploit payload can be exported if a message were forwarded into a group by a member (it is not necessary for the message author to be a member of a group).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/21/2026
The vulnerability identified in Telegram Desktop versions prior to 6.9.4 represents a significant cross-site scripting flaw located within the application's HTML export functionality, specifically triggered through the button.text.toUtf8 method found in the export_output.cpp module. This security defect allows an attacker to inject malicious script payloads into content that is subsequently processed by the client during the generation of static HTML files from chat messages or groups. The core technical failure stems from insufficient sanitization and encoding validation when handling user-supplied text data, particularly within button components where UTF-8 conversion occurs without adequate checks for embedded executable code structures. This oversight enables the injection of arbitrary JavaScript that can execute in the context of the victim's local environment once the exported HTML is opened or rendered by a web browser or integrated viewer.
The operational impact of this vulnerability is nuanced due to its specific exploitation vector, which requires active participation from the user beyond mere exposure to malicious content. Exploitation cannot occur passively through standard message viewing; instead, it necessitates that the victim explicitly utilizes the HTML export feature on compromised data. This creates a higher barrier for initial compromise but does not eliminate risk entirely because of the social engineering potential inherent in group dynamics. An attacker can craft a deceptive message containing the exploit payload and forward it into a target group by any member, regardless of whether that forwarding user is an official member of the group or merely a participant with permission to send messages. This flexibility allows attackers to bypass membership restrictions commonly used for security isolation within private groups, thereby expanding the attack surface significantly.
From a classification perspective, this vulnerability aligns closely with CWE-79, which defines Improper Neutralization of Input During Web Page Generation known as Cross-site Scripting (XSS). The specific mechanism involves server-side or client-side processing of untrusted data without proper validation, leading to the execution of unintended scripts. In terms of tactical mapping within the MITRE ATT&CK framework, this behavior corresponds to techniques involving Client-Side Injection and potentially Initial Access if leveraged in conjunction with phishing campaigns that trick users into exporting specific files containing malicious payloads. The ability for non-members to forward messages into groups further complicates attribution and detection efforts, as standard access control logs may not immediately flag the origin of the compromised content as anomalous based on membership status alone.
Mitigation strategies must prioritize immediate software updates to version 7.0.1 or later, which addresses this flaw by implementing stricter input validation and output encoding within the HTML export module. Developers should ensure that all user-supplied text fields undergo rigorous sanitization before being processed into static formats, particularly when dealing with rich media elements like buttons where complex data structures are involved. Additionally, users should be educated to exercise caution when exporting chat histories or group contents from untrusted sources, as this action serves as the critical trigger for vulnerability activation. Security teams monitoring Telegram deployments should also consider implementing application whitelisting policies that restrict the execution of scripts within exported HTML files unless explicitly authorized by trusted domains, thereby adding a layer of defense-in-depth against potential exploitation even if the underlying software remains vulnerable in older versions.