Description
Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. (The first fixed stable version is 7.0.1.) This occurs in button.text.toUtf8 in export_output_html.cpp. Exploitation cannot occur unless HTML export was used by a victim. However, the exploit payload can be exported if a message were forwarded into a group by a member (it is not necessary for the message author to be a member of a group).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Telegram | Telegram Desktop | 4.15.1 – < 6.9.4 | 6.9.4 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | telegram-desktop | 5.7.2+ds-6 | — |
References
- tdesktop commit 8457d13a - Fix escaping in HTML export of keyboards patch
- tdesktop commit 52c779bf - Added support of inline markup reply to HTML export (introduces the issue) related
- Telegram Desktop v6.9.4 - first release containing the fix release-notes
- Vulnerable export_output_html.cpp as shipped in v6.9.3 related
- Expatch LLC technical write-up third-party-advisory technical-description exploit
- https://thehackernews.com/2026/09/telegram-desktop-flaw-lets-hidden.html media-coverage