CVE-2026-94488: Telegram Desktop XSS Vulnerability

CVE-2026-94488 Overview

CVE-2026-94488 is a Cross-Site Scripting (XSS) vulnerability [CWE-79] in Telegram Desktop before version 6.9.4. The flaw resides in the HTML exporter, specifically in the button.text.toUtf8 code path within export_output_html.cpp. Attacker-controlled inline keyboard button text is written into the exported HTML without proper escaping, allowing arbitrary script execution when the victim opens the exported file.

Exploitation requires that the victim used Telegram Desktop's HTML export feature. The malicious payload can reach the export if a message is forwarded into a group by any member, and the original message author does not need to be a group participant. The first fixed stable release is 7.0.1, with the initial patched build available in 6.9.4.

Critical Impact
Successful exploitation delivers arbitrary JavaScript execution in the victim's browser context when they open a Telegram HTML export, exposing chat contents and locally accessible resources.

Affected Products

Telegram Desktop versions prior to 6.9.4
Telegram Desktop 6.9.3 and earlier stable branches
HTML export functionality in export_output_html.cpp

Discovery Timeline

2026-09-21 - CVE-2026-94488 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-94488

Vulnerability Analysis

The vulnerability exists in Telegram Desktop's HTML chat exporter. When rendering inline bot keyboard buttons, the exporter concatenates the button's content string directly into a JavaScript onclick handler. The resulting HTML is written to disk without escaping single quotes or backslashes.

When the victim opens the exported HTML file in a browser, the injected payload executes in the file's origin. This grants the attacker access to the exported chat data rendered in the page, along with any browser-side capabilities available to local HTML content.

Root Cause

The pre-patch code in export_output_html.cpp built the click handler using a raw concatenation pattern:

("return ShowTextCopied('" + content + "');").toUtf8()

Because content originates from untrusted message data (button labels), an attacker can inject a closing single quote followed by arbitrary JavaScript. No output encoding or sanitization was applied to break out of the string literal.

Attack Vector

An attacker crafts a message containing an inline keyboard button whose text embeds a JavaScript payload. Any group member can forward that message into a target group; the attacker does not need direct access to the target. When any member of that group later runs HTML export and opens the resulting file, the payload executes.

cpp

// Patch: Telegram/SourceFiles/export/output/export_output_html.cpp
// Commit: 8457d13aa795fadf99c955d2a04f00ebc3c59df9
					? button.data
					: QByteArray();
				const auto onclick = (button.type != Type::Url)
-					? ("return ShowTextCopied('" + content + "');").toUtf8()
+					? ("return ShowTextCopied('"
+							+ QString(content)
+								.replace('\\', u"\\\\"_q)
+								.replace('\'', u"\\'"_q)
+							+ "');").toUtf8()
					: QByteArray();

Source: Telegram Desktop Commit 8457d13. The fix escapes backslashes and single quotes in content before embedding it in the JavaScript string literal.

Detection Methods for CVE-2026-94488

Indicators of Compromise

Telegram Desktop HTML export files containing inline keyboard buttons with onclick handlers whose arguments include unescaped single quotes or <script> fragments.
Browser process instances loading file:// URLs pointing to Telegram export directories followed by outbound network activity.
Presence of Telegram Desktop binaries at version 6.9.3 or earlier on user endpoints.

Detection Strategies

Inspect exported Telegram HTML archives for anomalous JavaScript inside ShowTextCopied('...') calls that break the expected single-argument pattern.
Hunt for forwarded messages containing bot inline keyboards with atypical button-label characters such as single quotes, angle brackets, or javascript: sequences.
Correlate execution of Telegram.exe export operations with subsequent browser launches of local HTML files from the same directory.

Monitoring Recommendations

Track installed Telegram Desktop versions across managed endpoints and flag any host below 6.9.4.
Monitor endpoint file creation events for Telegram export folders and inventory the resulting HTML artifacts.
Alert on browser child processes spawning network connections shortly after opening a Telegram export file.

How to Mitigate CVE-2026-94488

Immediate Actions Required

Upgrade all Telegram Desktop installations to version 7.0.1 or later, or at minimum to the patched 6.9.4 build.
Advise users to avoid running HTML export on chats that received forwarded content from untrusted sources until patched.
Delete or quarantine any HTML exports generated by vulnerable versions that originated from group chats.

Patch Information

The fix landed in Telegram Desktop 6.9.4, with 7.0.1 designated as the first fixed stable release. See the Telegram Desktop Release v6.9.4 notes and the corrective commits 52c779b and 8457d13. Additional context is available in the Exploit Write-up: Telegram XSS and The Hacker News Telegram Flaw Report.

Workarounds

Refrain from using the Telegram Desktop HTML export feature until upgrading to a patched release.
If export is required, use the JSON export format instead, which is not affected by this HTML escaping flaw.
Open any legacy exports in a sandboxed browser profile with JavaScript disabled to prevent payload execution.

bash

# Verify the installed Telegram Desktop version on Linux
telegram-desktop --version

# On Windows, query the installed version via PowerShell
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "Telegram Desktop*" } |
  Select-Object DisplayName, DisplayVersion

# Any version below 6.9.4 must be upgraded