A stored cross-site scripting vulnerability in Telegram Desktop’s HTML chat-export feature could let attackers steal the contents of exported conversations.
The flaw, tracked internally through Telegram Desktop’s source repository but not assigned a CVE, affected exports generated before Beta version 6.9.4 and stable version 7.0.1.
ExPatch Vulnerability Research disclosed the issue after Telegram patched the bug in July 2026. Researchers Denis Rostilov and Aleksander Rostilov said an attacker could embed malicious JavaScript inside the text of an inline keyboard button sent by a Telegram bot.
Telegram Desktop Stored XSS Flaw
The code would remain dormant in a chat’s message history until a participant exported the conversation as HTML and opened the resulting file in a web browser.
Unlike conventional stored XSS attacks, the malicious bot would not necessarily need to join the target group. A bot could send a seemingly benign message with a URL-based inline keyboard to another user, who could then forward it into a group or supergroup.
Telegram preserves compatible URL buttons during forwarding, allowing the attacker-controlled button text to persist in the new chat history.
ExPatch said the payload could be obscured with invisible Unicode characters, making the button appear blank or harmless in the Telegram interface.
Telegram Desktop itself displayed the malicious HTML as ordinary text because it does not render chat content through a browser engine. However, the HTML export process wrote the button text directly into the generated page without escaping dangerous characters.
The vulnerable code path was located in export_output_html.cpp. Telegram Desktop used a SerializeString() function to escape HTML-sensitive characters in message bodies, sender names, and other exported fields.
But inline keyboard button text was inserted using button.text.toUtf8() without the same sanitization, enabling tags such as <script> to become executable markup when the exported HTML file was opened.
Once triggered, the script could access all messages rendered in the export document, including sender names, timestamps, chat metadata, and potentially sensitive content such as internal credentials or business discussions.
It could also read the page’s local file URL, which may reveal parts of the victim’s username and directory structure. Beyond data theft, the vulnerability enabled complete manipulation of the exported page’s Document Object Model.
An attacker could replace the chat export with a fraudulent Telegram-branded verification page, hide messages, alter displayed timestamps or names, or rewrite conversation content.
While such changes would not modify Telegram’s server-side history, they could undermine the reliability of exported chats used for compliance, legal review, or internal investigations.
The researchers rated the flaw CVSS 3.1 8.2, or High severity, using the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. Exploitation required a victim to export a chat as HTML and open the file, but did not require the attacker to obtain access to the target group’s ordinary message traffic.
Telegram fixed the issue in commit 8457d13a, titled “Fix escaping in HTML export of keyboards.” The patch applies HTML escaping to button text and also addresses a related JavaScript-string injection risk involving copy-callback buttons.
Users should update Telegram Desktop to version 7.0.1 or later on the stable channel, or version 6.9.4 or later on the Beta channel.
Previously generated HTML exports should be treated as potentially unsafe, particularly if they contain messages from large groups or untrusted forwarded content. Re-exporting chats after updating, or opening legacy exports with JavaScript disabled, can reduce exposure.
Detect 58% more threats with fresh intelligence from 16K+ organizations. Integrate TI Feeds in you SOC
