Telegram Desktop Flaw Lets Hidden JavaScript Exfiltrate Messages From HTML Exports

A flaw in Telegram Desktop let a bot's message plant hidden JavaScript inside chats that users exported to HTML files, security researchers at ExPatch said in a writeup published on September 12.

In Telegram, the message looked ordinary, with a link button, and the script ran only when someone opened the export file in a web browser. It could then copy every message in that file to an attacker-controlled server, or rewrite what the page displayed.

Telegram shipped a fix in July, but the app update does not update files exported with earlier versions, so old HTML exports can still carry the script.

Telegram Desktop, Telegram's app for Windows, macOS, and Linux, can save a single chat or all chats from an account as HTML pages that open in a browser. Bots can attach rows of buttons under their messages, which Telegram calls inline keyboards, and the bot chooses the text shown on each button.

Until the fix, the export code wrote that button text directly into the HTML page without escaping it, the researchers Denis Rostilov and Aleksander Rostilov found.

Escaping converts characters such as < so that a browser shows them as text instead of treating them as code, and the export applied it to message text, sender names, and other fields.

A bot could therefore put a script tag in a button's text, padded with invisible characters so that the button looked empty in the Telegram Desktop build they tested.

The bot does not need to be in the chat it targets. A message whose only buttons are web links keeps those buttons when it is forwarded, so any member who forwards the bot's message into a group carries the script with it, the researchers found. The message then sits in the chat's history like any other until it is deleted, and can be exported months or years later.

They reported the flaw to Telegram on June 3, two days after finding it, and say they tested it only on their own accounts and test groups. Their writeup does not claim that anyone has used the flaw against real users.

When an export file containing the message was opened, the script ran without any further click, the researchers said. It could read every message in that file, including sender names and timestamps, the chat's name, type, and member count, and the local file path, and send them all to the attacker's server.

Telegram Desktop's export code splits long exports into files of 1,000 messages each, so one file exposes at most its own contents, not the whole chat or the Telegram account.

The script could also rewrite the page. In the researchers' demonstration, it replaced the whole export with a fake Telegram "verification" form.

The same control could change dates, senders, or message text in a file being used as a record, they said. It did not change Telegram's own copy of the chat or the export file saved on disk.

The researchers rated the flaw 8.2 out of 10 on the CVSS 3.1 scale, and no score from Telegram or from the U.S. National Vulnerability Database (NVD) exists as of September 14.

Three things had to be true for the script to run: the HTML export was made using a Telegram Desktop version before the fix, the message carrying the script fell within the exported chat, and the file was opened in a browser with JavaScript enabled.

The researchers examined only Telegram Desktop's HTML export and did not address the JSON export format or the export features of Telegram's other apps.

Whether a forwarded bot message ends up in an export depends on how the export is made. Exporting a single chat from its menu includes every member's messages. A full-account export includes, by default, only the account owner's own messages in groups and channels, but all messages in one-to-one chats and chats with bots, according to the export code and Telegram's documentation.

The fix, commit 8457d13a by Telegram Desktop developer John Preston, adds the missing escaping. It was written on June 30 and reached the 6.9.4 beta on July 3 and the 7.0.1 stable release on July 14, the first fixed versions published on GitHub. The unescaped line had been in stable releases since 4.15.1 in March 2024, about two years and four months.

• Affected: Telegram Desktop 4.15.1 (March 2024) through 6.9.3
• Fixed: 6.9.4 beta (July 3, 2026), 7.0.1 (July 14, 2026) and later

The researchers advise users to:

• Update Telegram Desktop to 7.0.1 or later, or to 6.9.4 or later on the beta channel.
• After updating, export again any chats that were exported to HTML before the fix, or open the old files only with JavaScript disabled.
• Treat any HTML export made before the fix as untrusted, especially one from a large group where the origin of each message is hard to check.

Until the app is updated, there is no reason to create new HTML exports, since only exports produced by the older code carry the flaw.

As of September 14, Telegram had published no guidance for users holding older exports.

No Advisory, No CVE

The release notes for 6.9.4 and 7.0.1, the app's changelog and Telegram's July 14 announcement of the update do not mention the fix, and the Telegram Desktop repository on GitHub lists no security advisories.

There is also no CVE identifier for the flaw. The researchers noted that as of September 11, a search of public vulnerability databases by The Hacker News on September 14 found none.

The researchers say that Telegram confirmed the flaw on July 1 and offered a $500 bug bounty, which they declined and asked to be given to charity. They asked for a coordinated publication date and offered to stay silent until the patch shipped.

"We also have considered the possibility of a public disclosure, but we cannot approve it as disclosing even the already addressed issues could put more Telegram users at risk in the future. For instance, if information about a vulnerability is made public, malicious actors may attempt to exploit it, thereby causing financial harm to Telegram users," Telegram Support wrote in an email dated July 1 that the researchers published as a screenshot.

The researchers read that as a refusal to allow publication even after a fix. They say no non-disclosure agreement covered their report, and they published on September 12, after the fix had shipped.

Telegram's published bug bounty rules say that vulnerabilities "disclosed to the public or to third parties before they are addressed" are not eligible for a bounty. The page says nothing about publication after a fix.

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.