Stored XSS in Telegram's Telegram Desktop HTML exporter can expose exported chats

Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. (The first fixed stable version is 7.0.1.) This occurs in button.text.toUtf8 in export_output_html.cpp. Exploitation cannot occur unless HTML export was used by a victim. However, the exploit payload can be exported if a message were forwarded into a group by a member (it is not necessary for the message author to be a member of a group).

• Telegram Desktop on Windows, macOS, and Linux is affected for semver >=4.15.1 and <6.9.4, described by the sources as 4.15.1 through 6.9.3.
• The affected component is export_output_html.cpp in the HTML chat-export module, especially the HtmlWriter::Wrap::pushMessage path.
• The first fixed beta release is 6.9.4.
• The first fixed stable release is 7.0.1.
• Public technical analysis confirms only HTML export. The status of JSON export and export features in other Telegram applications is not established.
• HTML exports created by affected builds may still contain a dangerous payload after the application is updated.

Telegram Desktop places inline keyboard button text into the HTML export without applying the required escaping. In the vulnerable path, HtmlWriter::Wrap::pushMessage appends button.text.toUtf8() directly to the HTML document; the fix applies SerializeString(...) to that content. An attacker-controlled message can carry content that a browser interprets as JavaScript, and such a message can be forwarded into a group by a member even when the message author is not a group member. Exploitation requires a victim to create an HTML export containing the message and open the file in a browser with JavaScript enabled. Once opened, injected code can read messages and metadata rendered in the document, send them externally, or alter the displayed page; the available evidence does not show modification of Telegram's server-side history or the saved export file on disk. The confirmed scope is the HTML chat-export module on Windows, macOS, and Linux; JSON export and export features in other Telegram applications were not established as affected.

The flaw is triggered in the victim's local export workflow, not when Telegram Desktop merely displays the message in its own application UI. The record and technical analysis indicate that an attacker does not need to belong to the target group; a payload-bearing message can be forwarded into the group by any member. The victim must export a chat containing the message and open the resulting file in a browser that permits JavaScript execution. The public demonstration states that the script ran without an additional click after the file was opened. A public proof of concept and technical demonstration are available, but the researchers said they tested only their own accounts and test groups and did not claim exploitation against real users.

Successful exploitation allows JavaScript to run in the browser context that opens the HTML export file. The code can read data rendered in the document, send data externally, and change what the user sees. The demonstrated impact is document-level because the available evidence does not show modification of Telegram's server-side history or the export file stored on disk. The amount of exposed data depends on the contents of the opened file and does not automatically include an entire account or all chat history. The risk is especially significant for exports used as records or evidence because the displayed content can be falsified in the browser context.

When a poisoned HTML export is opened, running code can read messages, sender names, timestamps, and metadata rendered in that file and send the data to an attacker-controlled server. The displayed export can also be altered, creating risk for audit, legal, compliance, or investigative records viewed through a browser. The available evidence limits the demonstrated impact to the opened export document; it does not show modification of Telegram's server-side history or the saved file on disk. Older HTML exports can remain dangerous after the application is updated because updating the client does not rewrite files created earlier.

1. For the stable branch, update Telegram Desktop to 7.0.1. For the beta branch, use 6.9.4, identified as the first beta release containing the fix.
2. Recreate important HTML exports using a fixed build. Updating the application does not automatically sanitize or rewrite HTML files created earlier.
3. Until they are recreated, treat HTML exports made before the fix or with unknown provenance as untrusted data. Do not open them in a browser with JavaScript enabled; if inspection is necessary, disable JavaScript first.
4. Review retained group exports, especially those containing forwarded messages or inline keyboard buttons, and restrict sharing of files that have not been recreated.

1. Inventory Telegram Desktop installations on Windows, macOS, and Linux, and identify systems that use HTML chat export or retain exported HTML files.
2. Locate HTML exports created before the fix or with unknown provenance. Do not open these files directly in a browser with JavaScript enabled.
3. Prioritize review of group exports containing forwarded messages or inline keyboard buttons, because these are the carrier conditions described in the public analysis.
4. If content must be inspected, use a copy without sensitive data and disable JavaScript in the browser before opening it.
5. Browser and network telemetry can be reviewed for unexpected outbound requests or unusual page changes when an old HTML file is opened. This is precautionary monitoring only; the reviewed sources do not define a product-specific IOC or log event.