Full Report
A flaw in Telegram Desktop let a bot's message plant hidden JavaScript inside chats that users exported to HTML files, security researchers at ExPatch said in a writeup published on September 12. In Telegram, the message looked ordinary, with a link button, and the script ran only when someone opened the export file in a web browser. It could then copy every message in that file to
Analysis Summary
# Vulnerability: Stored XSS in Telegram Desktop HTML Export
## CVE Details
- **CVE ID**: Not yet assigned (as of September 14, 2026)
- **CVSS Score**: 8.2 (High) - *Researcher estimate (ExPatch)*
- **CWE**: CWE-79 (Improper Neutralization of Input During Web Page Generation / Cross-site Scripting)
## Affected Systems
- **Products**: Telegram Desktop (Windows, macOS, and Linux)
- **Versions**: 4.15.1 through 6.9.3
- **Configurations**: Occurs when a user performs an "Export Chat History" to HTML format and subsequently opens that file in a web browser with JavaScript enabled.
## Vulnerability Description
A Cross-Site Scripting (XSS) vulnerability existed in the Telegram Desktop export engine. While the application escaped characters for message text and sender names, it failed to escape the text within "inline keyboard" buttons attached by bots.
An attacker could create a bot message containing a `<script>` tag within a button's text field. Because the export code wrote this text directly into the HTML file without sanitization, the script would execute automatically when the exported HTML file was viewed in a browser.
## Exploitation
- **Status**: PoC available (tested by ExPatch researchers); no reports of exploitation in the wild.
- **Complexity**: Low (requires a user to export chat history and open the file).
- **Attack Vector**: Network (delivered via a bot message, which can be forwarded into target groups).
## Impact
- **Confidentiality**: **High**. The script can read all messages, timestamps, and sender details within the 1,000-message export block and exfiltrate them to a remote server.
- **Integrity**: **High**. The script can rewrite the DOM of the exported page to alter message content or display fake "verification" forms to phish for further credentials.
- **Availability**: **Low**. Does not affect the availability of the Telegram service itself, only the integrity of the local export file.
## Remediation
### Patches
- **Telegram Desktop v7.0.1 (Stable)**: Released July 14, 2026.
- **Telegram Desktop v6.9.4 (Beta)**: Released July 3, 2026.
### Workarounds
- **Delete Suspicious Messages**: Remove bot messages with empty or unusual buttons from the chat history before performing an export.
- **Disable JavaScript**: Open exported HTML files in a browser environment where JavaScript is disabled.
- **Use JSON Export**: The vulnerability specifically targeted the HTML export format; JSON exports were not cited as vulnerable in this report.
## Detection
- **Indicators of Compromise**:
- Exported HTML files containing `<script>` tags within button elements.
- Bot messages that appear to have "empty" or invisible buttons (used to hide the payload).
- **Detection Methods**: Security teams can scan existing HTML chat exports for script tags or unexpected external network requests initiated when the file is opened.
## References
- **ExPatch Writeup**: hxxps[://]expatch[.]com/writeups/telegram-html-export-xss[.]html
- **Vendor Fix**: hxxps[://]github[.]com/telegramdesktop/tdesktop/commit/8457d13aa795fadf99c955d2a04f00ebc3c59df9
- **Release Notes**: hxxps[://]github[.]com/telegramdesktop/tdesktop/releases/tag/v7.0.1