The security vulnerability in Telegram Desktop could hijack exported chats

A script injection vulnerability that executes during the export of chats as HTML in Telegram Desktop has been fixed. The vulnerability was recorded as CVE-2026-94488. Telegram released the fix in July with version 6.9.4; the first fixed stable version is 7.0.1.

Hidden script coming from inside the chat

Telegram Desktop lets you save a single chat or all accounts as HTML pages that open in a browser. Bots can add button rows below their messages, which Telegram calls an inline keyboard, and the bot chooses the text that appears on the button. In versions before the fix, the export code wrote this button text into the HTML page without adding escape characters. Escaping was applied to the message text, sender name, and other fields; the button text was skipped.

Researchers Denis Rostilov and Aleksander Rostilov found the issue in early June and reported it to Telegram on June 3. A bot can place a script tag padded with invisible characters into the button text, so the button appears empty in Telegram.

How the attack works

The bot doesn’t even need to be a member of the target chat. Only buttons containing a web link are preserved when the message is forwarded to another group. If a group member forwards the bot’s message to their own group, the script also becomes embedded in the chat history and waits there until an export is done months later.

When the export file is opened in a browser, the script runs automatically; no additional click is needed. The script can read all messages, sender names, and timestamps in the file, the chat name, type, member count, and the file’s local path, and send them to the attacker’s server. Because Telegram Desktop splits long exports into files of 1000 messages, a single file only exposes its own contents, not the entire account. The script can also change the visible content of the page. In the researchers’ demonstration, the entire export was replaced with a fake Telegram verification form. The same path can also be used to alter dates, senders, or message texts in a file used as a record.

What should you do

Update Telegram Desktop. The vulnerability is present in versions before 6.9.4 (affected range starting from 4.15.1); in stable versions, the safe threshold is 7.0.1. Updating the app doesn’t solve one important detail: the fix does not clean up HTML export files produced with older versions. If you have a chat archive you’ve kept for years, re-export those files with the current version before opening them in a browser, or delete them.

The NVD entry gives the vulnerability’s vector as a structure requiring local access and user interaction; the CVSS 4.0 score is 8.3, and the CVSS 3.1 score is 8.2. In other words, the vulnerability comes into play when someone who has used the export feature opens the file.

Source: NVD · The Hacker News