A Telegram Desktop flaw let bots inject JavaScript into exported chats, enabling data theft and page manipulation. Old HTML exports remain unsafe.
A vulnerability in Telegram Desktop could have turned an ordinary chat export into a serious data leak. Security researchers Denis and Aleksander Rostilov of ExPatch found a stored cross-site scripting flaw in the application’s HTML export feature that allowed malicious JavaScript to hide inside a Telegram message and run later when someone opened the exported file in a browser.
“A stored XSS in Telegram Desktop lets an attacker plant invisible JavaScript in an exportable chat through a bot’s inline keyboard button. The payload can sit in message history for months and detonates when a participant opens an HTML export page containing that message.” reads the report published by ExPatch. “No second click, no warning: every message and metadata field rendered in that document can be shipped to the attacker’s server, and the page itself can be rewritten. The bot never joins the target chat — one forwarded message can be enough.”
The attack is unusual because the attacker doesn’t need to be a member of the target group. A bot can create a message containing a specially crafted inline keyboard, and that message can then be forwarded into other chats. Once included in the conversation history, the payload can remain there for months or even years, waiting for someone to export the chat.
The Telegram app itself doesn’t execute the code. That’s an important distinction. The problem appears when Telegram Desktop converts the stored conversation into an HTML document that is later opened in a browser, where the injected content is interpreted as JavaScript.
The researchers traced the problem to Telegram Desktop’s HTML export code. In export_output_html.cpp, the application wrote the text of inline keyboard buttons directly into the HTML output instead of passing it through the existing SerializeString() sanitization function. That meant HTML tags placed in the button text could be treated as real markup in the exported document.
“When exporting a chat to HTML, Telegram Desktop writes inline-button text straight into the HTML page — unescaped. SerializeString(), which escapes every HTML-dangerous character (<, >, &, ", '), converts newlines and Unicode line/paragraph separators to <br>, and hex-encodes ASCII control characters, is defined in the same file and applied to message text, sender names, and other fields. It just wasn’t applied to button text.” continues the report. “That means any HTML sitting in a button’s text property renders as live markup in the exported page. <script> tags included.”
This created a particularly awkward security boundary. Telegram’s Bot API can restrict a bot’s access to ordinary group messages, especially when privacy mode is enabled. But once the bot’s own message was exported as HTML, the injected script could run in the user’s browser context and access the other messages rendered on that page.
The potential impact is significant. According to the researchers, the injected code could read messages, sender names, timestamps and other chat metadata from the exported document and send that information to an attacker-controlled server. It could also access the local file path of the export, potentially revealing the user’s operating-system name and directory structure.
The attack could also manipulate the page itself. The proof of concept demonstrated how an attacker could replace the exported conversation with a fake Telegram verification page, while the same browser-side control could be used to alter displayed messages, timestamps and sender information. That doesn’t change the original Telegram history, but it could make a compromised export look completely different from the real conversation.
The researchers also demonstrated how the problem could spread through forwarding. A single poisoned message could be forwarded into multiple groups, where each copy would retain the malicious content. Anyone who later exported a conversation containing that message and opened the resulting HTML file could trigger the payload.
There was another important feature: the attack didn’t have to happen immediately. The malicious message could sit harmlessly in a chat history until someone performed a completely legitimate action months later. The export process effectively turned previously inert message data into executable content.
ExPatch rated the vulnerability CVSS 8.2, High. The researchers deliberately used a local attack vector because the vulnerable component is the local HTML export process, which runs only when the user explicitly exports a chat and opens the resulting file.
The flaw had been in production for more than two years. The vulnerable code was introduced in February 2024 and reached the stable 4.15.1 release in March that year. Telegram fixed it in June 2026, after the researchers reported the issue on June 3.
Telegram fixed the problem by applying SerializeString() to inline keyboard button text. The patch also addressed another injection issue involving content inserted into a JavaScript onclick handler.
The first fixed beta release was Telegram Desktop 6.9.4, while the first stable release containing the fix was 7.0.1, released on July 14, 2026. Telegram has since released newer versions, so users should be running a current build rather than relying on the minimum fixed version.
There is, however, a detail that could easily be missed. Updating Telegram Desktop doesn’t repair HTML files that were exported with an affected version. If one of those files contains the malicious payload, the JavaScript remains in the file and can still execute when the document is opened in a browser.
That makes old exports the main issue for organizations that use Telegram to retain conversations for compliance, investigations or business records. The researchers recommend creating new exports after updating and treating older HTML exports as untrusted, particularly when they came from large groups where it may be difficult to know where every message originated.
The disclosure process also raises a separate security question. ExPatch says it reported the vulnerability with a full proof of concept and video demonstration, while Telegram fixed the issue and offered a bounty that the researchers declined. Telegram then refused to approve public disclosure even after the vulnerability had been fixed.
As of September 11, the researchers said Telegram had not published a dedicated security advisory and that no public CVE had been assigned. The fix is visible in the Telegram Desktop source code, but users weren’t given a direct warning that older HTML exports could still contain executable content.
For defenders, the practical lesson is straightforward. Update Telegram Desktop, regenerate sensitive HTML exports created before the fix, and don’t open old Telegram HTML files in a normal browser unless you know where they came from and have checked them carefully. The update fixes the client, but it can’t go back in time and clean files already sitting on someone’s disk.
The vulnerability is a good reminder that security problems don’t always live in the messaging system itself. Sometimes the dangerous step happens later, when trusted data is converted into another format and that format is treated as executable content.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
Pierluigi Paganini
(SecurityAffairs – hacking, newsletter)
Entrar
