CVE-2026-94488
8.2 HIGHpublic exploit availablePublished 2026-09-21 · Updated 2026-09-21
AI risk analysis
- Summary
- The flaw allows for XSS in Telegram Desktop before version 6.9.4 due to improper handling of HTML export, posing a high risk if exploited.
- Exploitability
- Exploitation is moderately difficult as it requires the use of HTML export and forwarding by a group member; direct author involvement is not necessary.
- Blast radius
- If exploited, this could lead to arbitrary script execution in victims' browsers, potentially compromising user data or systems.
- Prioritized remediation
- Update Telegram Desktop to version 7.0.1 or later immediately.
Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. (The first fixed stable version is 7.0.1.) This occurs in button.text.toUtf8 in export_output_html.cpp. Exploitation cannot occur unless HTML export was used by a victim. However, the exploit payload can be exported if a message were forwarded into a group by a member (it is not necessary for the message author to be a member of a group).
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Weaknesses
CWE-79
Public exploit & PoC references
- https://github.com/telegramdesktop/tdesktop/blob/v6.9.3/Telegram/SourceFiles/export/output/export_output_html.cpp
- https://github.com/telegramdesktop/tdesktop/commit/52c779bffa8dde3c5c09826add2607328fae0924
- https://github.com/telegramdesktop/tdesktop/commit/8457d13aa795fadf99c955d2a04f00ebc3c59df9
- https://github.com/telegramdesktop/tdesktop/releases/tag/v6.9.4
All references
- https://expatch.com/writeups/telegram-html-export-xss.html
- https://github.com/telegramdesktop/tdesktop/blob/v6.9.3/Telegram/SourceFiles/export/output/export_output_html.cpp
- https://github.com/telegramdesktop/tdesktop/commit/52c779bffa8dde3c5c09826add2607328fae0924
- https://github.com/telegramdesktop/tdesktop/commit/8457d13aa795fadf99c955d2a04f00ebc3c59df9
- https://github.com/telegramdesktop/tdesktop/releases/tag/v6.9.4
- https://thehackernews.com/2026/09/telegram-desktop-flaw-lets-hidden.html
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2025-71419PoC
- MEDIUMCVE-2026-16069
- HIGHCVE-2026-16143
- MEDIUMCVE-2026-16293
- HIGHCVE-2026-16573
- HIGHCVE-2026-17506
- MEDIUMCVE-2026-36468PoC
- MEDIUMCVE-2026-36472PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.