Telegram Desktop HTML export: stored XSS via inline-keyboard button text
ExPatch (Denis and Aleksander Rostilov; writeup 12 September 2026; The Hacker News 14 September) detail a stored XSS in Telegram Desktop’s HTML chat export: inline-keyboard button text was written into export HTML without escaping (message body and names were escaped). A bot could hide a script in button text; forwarded link-button messages keep the payload; opening an old export in a browser runs the script and can exfiltrate that file’s messages/metadata or rewrite the page (fake verification form demo). No in-the-wild use claimed. Reported to Telegram 3 June 2026. Affected stable: 4.15.1 (March 2024) through 6.9.3. Fixed: 6.9.4 beta (3 July 2026), 7.0.1 stable (14 July 2026) and later. App update does not scrub previously exported HTML. No CVE assigned as of THN’s 14 September check. Primary: ExPatch; vendor: tdesktop 7.0.1; secondary: THN.
- Product
- Telegram Desktop (Windows, macOS, Linux HTML export)
- Versions
- Affected 4.15.1 through 6.9.3; fixed 6.9.4 beta / 7.0.1+
- Exploited in Australia?
- unknown
- Patch to
- Upgrade Telegram Desktop to 7.0.1 or later (or 6.9.4+ beta); treat pre-fix HTML exports as untrusted; re-export after upgrade if archives are retained
Primary: ExPatch — Telegram Desktop HTML export XSS (12 Sep 2026) · Vendor: Telegram Desktop v7.0.1 release · The Hacker News (14 Sep 2026)