Log in Start free

Vulnerability · Published Sep 21, 2026 · Assigned by mitre

CVE-2026-94488

High 8.2

In plain English

A high-severity cross-site scripting in Telegram Desktop from Telegram. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.2High
Exploit odds (30 days)0.1%top 96.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. (The first fixed stable version is 7.0.1.) This occurs in button.text.toUtf8 in export_output_html.cpp. Exploitation cannot occur unless HTML export was used by a victim. However, the exploit payload can be exported if a message were forwarded into a group by a member (it is not necessary for the message author to be a member of a group).

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:14telegram-desktop5.7.2+ds-6DEBIAN-CVE-2026-94488

Affected products (as reported)

VendorProductVersions
Telegram Telegram Desktop 4.15.1 – before 6.9.4

Weakness: CWE-79 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

References