Security researchers **Denis Rostilov** and **Aleksander Rostilov** of **ExPatch** have unveiled a significant cross-site scripting (XSS) vulnerability within **Telegram Desktop** that could have led to the compromise of user data. The flaw, detailed in a [writeup published on September 12](https://expatch.com/writeups/telegram-html-export-xss.html), allowed a bot's message to plant hidden **JavaScript** inside chats, which would then execute when users exported these chats to HTML files and opened them in a web browser.  ### How the Vulnerability Worked **Telegram Desktop**, the application for Windows, macOS, and Linux, allows users to export individual chats or an entire account's chat history as HTML pages. Bots can attach interactive inline keyboards with custom button text. The vulnerability stemmed from the export code's failure to properly escape this button text, writing it directly into the HTML without converting special characters like `<` to their HTML entities. This oversight enabled an attacker to inject `script` tags into a button's text, which, when padded with invisible characters, would appear as an empty button within **Telegram Desktop**. The script would then lie dormant until the chat was exported and the HTML file opened in a browser. Crucially, the bot didn't need to be a direct participant in the target chat. A message containing the malicious buttons, when forwarded, would carry the embedded script with it, making it part of the chat's history for potential future export. ### Impact of the Exploit Upon opening an exported HTML file containing the malicious message, the embedded **JavaScript** would execute automatically without any further user interaction. This script could: * Copy every message within that specific export file, including sender names, timestamps, chat names, and even local file paths, to an attacker-controlled server. * Rewrite the content displayed on the page. In a demonstration, the researchers showed how it could replace the entire export with a fake **Telegram** "verification" form. * Alter historical records by changing dates, senders, or message text within the local export file, without affecting **Telegram's** server-side copy. It's important to note that **Telegram Desktop's** export function splits long exports into files of 1,000 messages each, limiting the scope of data exposure to the contents of a single compromised file. ### Patch and Remediation **Telegram** addressed the flaw with [commit 8457d13a](https://github.com/telegramdesktop/tdesktop/commit/8457d13aa795fadf99c955d2a04f00ebc3c59df9) by developer **John Preston**, which introduced the missing escaping. This fix was integrated into the **6.9.4 beta** release on July 3 and the stable **7.0.1** release on July 14. The vulnerability had been present in stable releases from **4.15.1** (March 2024) through **6.9.3**. **Affected Versions:** **Telegram Desktop** 4.15.1 (March 2024) through 6.9.3 **Fixed Versions:** **Telegram Desktop** 6.9.4 beta (July 3, 2026), 7.0.1 (July 14, 2026) and later Users are strongly advised to: 1. Update **Telegram Desktop** to version **7.0.1** or later (or **6.9.4** on the beta channel). 2. Re-export any chats that were exported to HTML using older, vulnerable versions of the app. 3. Alternatively, open old HTML export files only with **JavaScript** disabled in the browser. 4. Treat any HTML export created before the fix as untrusted, especially those from large groups where message origins are difficult to verify. ### Lack of Public Disclosure The researchers reported the flaw to **Telegram** on June 3. While **Telegram** acknowledged the issue on July 1 and offered a $500 bug bounty (which **ExPatch** declined, requesting it be given to charity), there was no public advisory or **CVE** identifier issued. **Telegram's** communication indicated a reluctance to allow public disclosure, even after a fix, citing potential risks to users. Despite this, **ExPatch** proceeded with publication on September 12, after the patch had shipped, noting that no non-disclosure agreement was in place. The absence of a formal security advisory or **CVE** leaves many users potentially unaware of the risks associated with older exports.