Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-94488

Telegram Desktop · Vulnerability

CVSS 4.0 8.3 HIGHCVSS 3.1 8.2 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-94488

Published

Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. (The first fixed stable version is 7.0.1.) This occurs in button.text.toUtf8 in export_output_html.cpp. Exploitation cannot occur unless HTML export was used by a victim. However, the exploit payload can be exported if a message were forwarded into a group by a member (it is not necessary for the message author to be a member of a group).

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-94488

Published

Telegram Desktop

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "modules": [
                        "export_output_html.cpp (HTML chat-export module)"
                    ],
                    "platforms": [
                        "Windows",
                        "MacOS",
                        "Linux"
                    ],
                    "product": "Telegram Desktop",
                    "programFiles": [
                        "Telegram/SourceFiles/export/output/export_output_html.cpp"
                    ],
                    "programRoutines": [
                        {
                            "name": "HtmlWriter::Wrap::pushMessage"
                        }
                    ],
                    "repo": "https://github.com/telegramdesktop/tdesktop",
                    "vendor": "Telegram",
                    "versions": [
                        {
                            "lessThan": "6.9.4",
                            "status": "affected",
                            "version": "4.15.1",
                            "versionType": "semver"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON