CVE-2026-94488
8.2 HIGHpublic exploit availablePublished 2026-09-21 · Updated 2026-09-22
AI risk analysis
- Summary
- The flaw allows for Cross-Site Scripting (XSS) in the HTML exporter of Telegram Desktop before 6.9.4, which could lead to arbitrary script execution in the victim's browser if they opened a maliciously crafted message.
- Exploitability
- Exploitation is moderately difficult as it requires a victim to open a forwarded message containing the exploit payload in a group chat. The attacker must first craft and send the malicious message.
- Blast radius
- If exploited, the impact is limited to the victim's browser, potentially leading to data theft or further attacks if the victim's session is compromised.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to Telegram Desktop 7.0.1 or later.
xsshtml-exporttelegram
Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. (The first fixed stable version is 7.0.1.) This occurs in button.text.toUtf8 in export_output_html.cpp. Exploitation cannot occur unless HTML export was used by a victim. However, the exploit payload can be exported if a message were forwarded into a group by a member (it is not necessary for the message author to be a member of a group).
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Weaknesses
CWE-79
Public exploit & PoC references
- https://github.com/telegramdesktop/tdesktop/blob/v6.9.3/Telegram/SourceFiles/export/output/export_output_html.cpp
- https://github.com/telegramdesktop/tdesktop/commit/52c779bffa8dde3c5c09826add2607328fae0924
- https://github.com/telegramdesktop/tdesktop/commit/8457d13aa795fadf99c955d2a04f00ebc3c59df9
- https://github.com/telegramdesktop/tdesktop/releases/tag/v6.9.4
References
- https://expatch.com/writeups/telegram-html-export-xss.html
- https://github.com/telegramdesktop/tdesktop/blob/v6.9.3/Telegram/SourceFiles/export/output/export_output_html.cpp
- https://github.com/telegramdesktop/tdesktop/commit/52c779bffa8dde3c5c09826add2607328fae0924
- https://github.com/telegramdesktop/tdesktop/commit/8457d13aa795fadf99c955d2a04f00ebc3c59df9
- https://github.com/telegramdesktop/tdesktop/releases/tag/v6.9.4
- https://thehackernews.com/2026/09/telegram-desktop-flaw-lets-hidden.html
Data: NVD (public domain). Analysis: local $0 model. Defensive use only.