Telegram Desktop HTML Export XSS Let Hidden Bot JavaScript Steal Exported Chats; Fixed in 7.0.1

ExPatch researchers found a stored XSS (CVSS 3.1 8.2) in Telegram Desktop's HTML export feature, present since 4.15.1 (March 2024): unescaped bot inline-keyboard button text planted hidden JavaScript that could exfiltrate up to 1,000 messages per exported…

Researchers Denis and Aleksander Rostilov of ExPatch discovered that Telegram Desktop versions 4.15.1 (March 2024) through 6.9.3 wrote bot inline-keyboard button text into HTML chat exports without escaping, allowing a bot to embed invisible JavaScript. When a user opened an exported chat HTML file in a browser with JavaScript enabled, the script executed without any click, exfiltrating every message in that 1,000-message file, exposing metadata, rewriting displayed content, or presenting fake verification forms. Forwarded bot messages can carry the payload into group chats, where it can lie dormant in exportable history for months. The flaw was rated CVSS 3.1 8.2 and fixed by commit 8457d13a in Desktop Beta 6.9.4 (July 3, 2026) and Stable 7.0.1 (July 14, 2026). However, updating the app does not repair previously exported files, which remain unsafe; users should re-export old chats or open old exports only with JavaScript disabled. No CVE identifier or Telegram security advisory exists, and no exploitation in the wild has been reported.

• Vulnerability type: stored cross-site scripting (XSS) via unescaped bot inline-keyboard button text in Telegram Desktop's HTML export feature
• Affected versions: Telegram Desktop 4.15.1 (March 2024) through 6.9.3
• Severity: CVSS 3.1 score 8.2
• Impact: script executes on file open with JavaScript enabled, exfiltrating up to 1,000 messages per export file plus metadata, enabling DOM manipulation such as fake verification screens and content rewriting
• Persistence: forwarded bot messages carry the payload into group chats, where it can remain dormant in exportable history for months
• Fix: commit 8457d13a, shipped in Desktop Beta 6.9.4 (July 3, 2026) and Stable 7.0.1 (July 14, 2026)
• Limitation: updating the app does not fix previously exported HTML files; users should re-export old chats or open old exports with JavaScript disabled
• Attribution/discovery: ExPatch researchers Denis and Aleksander Rostilov