Security researchers Denis and Aleksander Rostilov (ExPatch) published a write-up on September 12 describing a JavaScript injection flaw they found in Telegram Desktop’s HTML chat export feature. When Telegram Desktop exports a conversation to HTML, the app writes the content to a file you can open in a web browser. The flaw — discovered on June 1 and reported to Telegram on June 3 — was in how the export handled button text attached to bot messages. Telegram’s inline keyboard feature lets bots display buttons under their messages; until the fix, the export wrote that button text directly into the HTML without escaping special characters. A malicious bot could put a <script> tag in a button’s label, hidden with invisible Unicode padding so the button appeared blank inside the Telegram app.
When a user opened an HTML export containing such a message in a browser, the script ran automatically — no click required. It could read every message, sender name, timestamp, chat name, and even the local file path within that export window, and send them to an attacker-controlled server. The script could also rewrite what the export page displayed, replacing it with a fake Telegram login form. The bot does not need to be present in the target chat; forwarding its message carries the payload along with it. Telegram shipped a fix in the 6.9.4 beta on July 3 and the 7.0.1 stable release on July 14 (commit 8457d13a). The fix adds proper HTML escaping to button text. No CVE identifier has been assigned. The researchers rated the flaw 8.2 out of 10 on CVSS 3.1. As of September 14, Telegram has not published any public guidance for users who may hold older exports.
How to check if you’re affected
Affected versions of Telegram Desktop are anything before 6.9.4 beta or 7.0.1 stable. Open Telegram Desktop → Settings → About (or check your system’s app version). If your version is 7.0.1 or later, the app will no longer generate vulnerable exports. However, HTML export files already created with older versions of the app can still carry the script — the patch does not retroactively sanitize them. If you made HTML chat exports before July 14, open those files cautiously or regenerate them with the updated app.