"We also have considered the possibility of a public disclosure, but we cannot approve it as disclosing even the already addressed issues could put more Telegram users at risk in the future," Telegram Support wrote in an email dated July 1.
How Telegram Desktop's HTML export let scripts slip through
Security researchers Denis Rostilov and Aleksander Rostilov disclosed a flaw in Telegram Desktop's HTML export that allowed hidden JavaScript to be embedded in exported chat pages. Telegram Desktop permits saving a single chat or all chats as HTML pages that open in a browser; its export code escaped message text, sender names and other fields, but—until the fix—failed to escape the text used for bot message inline keyboard buttons. That omission let a bot place a <script> tag inside a button's text. By padding that text with invisible characters the button could appear empty inside Telegram Desktop while still carrying executable code once the exported HTML file was opened in a browser.
Affected versions and the patch timeline
The unescaped line of code had been present since Telegram Desktop 4.15.1 (March 2024) and affected versions from 4.15.1 through 6.9.3. Telegram Desktop developer John Preston committed a fix (commit 8457d13a) on June 30; it reached the 6.9.4 beta on July 3 and the 7.0.1 stable release on July 14. The researchers reported the flaw to Telegram on June 3, say they received confirmation on July 1 and an offer of a $500 bug bounty, which they declined. The researchers published their writeup on September 12; as of September 14 Telegram had published no guidance for users holding older exports.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleWhat an exploited export can do
When an HTML export produced by an affected Telegram Desktop version is opened in a browser with JavaScript enabled, the embedded script runs without any further click. The researchers demonstrated that such a script could read every message contained within that exported file—sender names and timestamps included—plus the chat's name, type, member count and the local file path, and then send that data to an attacker-controlled server. Telegram Desktop divides long exports into files of 1,000 messages each, which limits any single file's exposure to the messages contained within it rather than the whole chat or entire account.
The script could also rewrite what the page displayed. In the researchers' demonstration it replaced the whole export with a fake Telegram "verification" form. The researchers noted that the injected script did not alter Telegram's own copy of the chat or the export file saved on disk; the change affected only the rendered page in the browser.
The researchers assigned a CVSS 3.1 score of 8.2 out of 10 to the flaw. As of September 14 there was no CVE identifier and no entry for the flaw in the U.S. National Vulnerability Database, and Telegram's release notes for 6.9.4 and 7.0.1 do not mention the fix.
Forwarding and export rules that let the script travel
A bot does not need to be a member of a target chat for the script to survive into an export. The export preserves a message's web-link buttons when that message is forwarded, so any member who forwards the bot's message into a group carries the button text—and the hidden script—into that group's history. That forwarded message then sits in the chat history like any other message until deleted and can be exported months or years later.
How and when a message appears in exports also matters. Exporting a single chat from its menu includes every member's messages. A full-account export, by default, includes only the account owner's own messages in groups and channels but includes all messages in one-to-one chats and chats with bots, according to the export code and Telegram's documentation—details the researchers flagged when assessing where the JavaScript could end up.
What users, security teams, and enterprises should do
- End users: Update Telegram Desktop to 7.0.1 or later (or to 6.9.4 or later on the beta channel). After updating, re-export any chats that were exported to HTML before the fix, or open older export files only with JavaScript disabled. Until you update, there is no reason to create new HTML exports, because only exports produced by the older code carry the flaw.
- Security teams and technologists: Treat any HTML export made before the fix as untrusted, especially exports from large groups where the origin of each message is hard to verify. Audit archived HTML exports and consider re-generating records after confirming the desktop client is updated to a patched release.
- Enterprises and record-keepers: If your organization relies on exported Telegram HTML files as records, re-export after updating Telegram Desktop, and do not rely on old HTML exports for legal or compliance evidence without validating their integrity—an attacker could alter the displayed page in the browser without changing Telegram's copy or the file on disk.
Rostilov and Rostilov say they tested the exploit only on their own accounts and test groups and do not claim that the flaw has been used against real users. Their public writeup followed a private disclosure, a brief coordination effort, and a patch; it also notes the absence of a public CVE or advisory as of September 14.
The immediate, practical step remains straightforward and concrete: update Telegram Desktop to a fixed version and treat older HTML exports as untrusted or open them only with JavaScript disabled. Beyond that, the record shows an unusual combination: a serious-export vulnerability fixed in July, a low-dollar bounty offer reported by Telegram, and no public advisory or CVE assigned as of mid-September—questions that organizations relying on exported chat archives will want answered if they depend on those files for records or investigations.
