CVE-2026-94488

Executive Summary

CVE-2026-94488 is a cross-site scripting (XSS) vulnerability in the HTML export functionality of Telegram Desktop versions prior to 6.9.4, with the first fixed stable release being 7.0.1. The flaw occurs in button.text.toUtf8 within export_output_html.cpp and enables an attacker to inject arbitrary HTML/script content into an exported HTML archive when a victim has used the HTML export feature and subsequently views the exported file. While exploitation requires prior use of the HTML export feature by the victim, the vulnerability is rated CVSS 8.2 due to its scope change and high confidentiality/integrity impact on the host system where the exported file is opened.

Technical Analysis

The vulnerability resides in Telegram Desktop's HTML exporter, specifically in the processing of button text during message export. The function button.text.toUtf8 in export_output_html.cpp fails to properly sanitize or encode button text before inserting it into the generated HTML output. This constitutes a classic improper neutralization of input during web page generation (CWE-79). Because the export process treats message content — including the text of interactive buttons — as trusted data, crafted input can break out of its intended HTML context and inject arbitrary markup or script.

The attack surface is local, as reflected by the AV:L metric: the exported HTML file is generated and opened on the victim's machine. The UI:R metric indicates the victim must interact with the malicious content, such as by exporting a chat that contains a crafted button and then opening the resulting HTML file in a browser or embedded viewer. The S:C (Scope Changed) metric reflects that the vulnerable component (Telegram Desktop exporter) can affect resources beyond its security scope (the local browser or rendering engine). C:H and I:H indicate high confidentiality and integrity impact, while availability is unaffected (A:N).

Notably, the NVD description states that "it is not necessary for the message author to be a member of a group" and that "the exploit payload can be exported if a message were forwarded into a group by a member." This means an attacker can deliver the payload by forwarding a crafted message (containing a malicious button) into a group that the victim is a member of, even if the attacker is not themselves a group member. This significantly widens the potential attack surface, as any forwarded message containing the crafted button can become a vector once export occurs.

The root cause is insufficient output encoding of button text when generating HTML. The exporter likely concatenates button text directly into HTML markup without applying entity encoding or attribute escaping. This allows characters such as <, >, ", ' to be interpreted as HTML syntax. The vulnerability is present in the export logic, not in the message rendering layer.

Exploitation Scenarios

Given the absence of public PoC or exploit code, the following attack chain is inferred strictly from the vulnerability class and available description:

1. Reconnaissance / Target Identification: The attacker identifies a victim who uses Telegram Desktop (version prior to 6.9.4/7.0.1) and is known to or likely to use the HTML export feature. The attacker may also target a group where members commonly archive chats.

2. Payload Delivery via Forwarded Message: The attacker crafts a message containing a button (e.g., an inline keyboard button) whose text contains malicious HTML/script. Because the vulnerability specifically affects button.text.toUtf8 during HTML export, the attacker ensures the button text includes payload characters. The attacker then forwards this message into a group where the victim is a member. The description explicitly notes the attacker does not need to be a member of the group; they can forward the crafted message into the group via a member or through other forwarding mechanisms.

3. Triggering the Flaw: The victim, when exporting the chat history to HTML, includes the forwarded message. During export, the vulnerable function processes the button text and writes it into the HTML output without proper encoding. The resulting HTML file contains the injected script.

4. Execution: The victim opens the exported HTML file in a web browser. The injected script executes in the context of the local file or the browser's rendering of the HTML. This could lead to theft of sensitive data from the exported chat (which may include private conversations), exfiltration of local files accessible via browser APIs, session hijacking if the browser context allows, or further malicious actions within the browser's security context.

5. Post-Exploitation Impact: With high confidentiality and integrity impact, the attacker could read exported chat contents, modify the HTML output, or use the browser context to access other local resources or perform actions on behalf of the user's browser session. The scope change means the impact is not limited to Telegram Desktop but extends to the browser environment and potentially the underlying operating system if browser vulnerabilities are chained.

Impact Assessment

The CVSS 3.1 score of 8.2 (High) is driven by the scope change and high confidentiality/integrity impacts. Though the attack vector is local and requires user interaction, the consequences are severe for affected users. Confidentiality impact is high because the exported HTML may contain sensitive chat history, and injected script could exfiltrate that data or other browser-accessible information. Integrity impact is high because the attacker can alter the exported content or perform actions as the user within the browser context. Availability is not impacted.

Business impact includes potential leakage of sensitive communications, intellectual property, or credentials present in exported chats. The requirement for HTML export to be used means the blast radius is limited to users who actively export chats in HTML format, but for those users the exposure can be significant. Organizations using Telegram Desktop for internal communications and archiving may be at risk. The lack of public exploit code and no CISA KEV listing indicates no active widespread exploitation at the time of this writing, but the vulnerability is trivially exploitable once a payload is crafted.

Detection Guidance

Sigma Rule

title: Telegram Desktop HTML Export XSS via Crafted Button Text
id: 9f4a2c1e-7b3d-4e5f-8a1b-2c3d4e5f6a7b
status: experimental
description: Detects potential exploitation of CVE-2026-94488 by identifying suspicious characters in button text within exported HTML files generated by Telegram Desktop.
author: Threat Intelligence
date: 2026-01-01
logsource:
  category: file_event
  product: windows
detection:
  selection_export:
    TargetFilename|endswith: '.html'
    TargetFilename|contains: 'Telegram'
  selection_content:
    # Placeholder for content-based detection; actual file content must be inspected
    # via separate script or EDR capability
    EventID: 11
  condition: selection_export and selection_content
falsepositives:
  - Legitimate HTML exports containing normal button text
level: medium
tags:
  - attack.t1204.002
  - cve.2026.94488

YARA Rule

rule CVE_2026_94488_Telegram_Desktop_HTML_Export_XSS
{
    meta:
        description = "Detects malicious HTML exports generated by Telegram Desktop containing XSS payloads in button text"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "CVE-2026-94488"
        severity = "high"

    strings:
        $html_export = "Telegram" nocase
        $button_pattern = "button" nocase
        $script_tag = "<script" nocase
        $onerror = "onerror" nocase
        $onload = "onload" nocase
        $javascript = "javascript:" nocase

    condition:
        $html_export and $button_pattern and any of ($script_tag, $onerror, $onload, $javascript)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-94488 Telegram Desktop HTML Export XSS Payload Delivery"; flow:to_client,established; content:"Telegram"; nocase; content:"button"; nocase; content:"<script"; nocase; distance:0; within:500; sid:202694488; rev:1; classtype:attempted-user; reference:cve,2026-94488; metadata:affected_product Telegram_Desktop, attack_target Client_Endpoint, deployment Perimeter, signature_severity Major, created_at 2026_01_01, cve CVE_2026_94488;)

Elastic Detection

file where file.extension == "html" and file.name : "*Telegram*" and file.size > 0

Splunk SPL Query

index=main sourcetype=file_event OR sourcetype=filesystem
| search file_path="*.html" file_path="*Telegram*"
| regex file_content="(?i)(<script|onerror|onload|javascript:)"
| stats count by host, user, file_path
| where count > 0

Wazuh OSSEC Rule

<group name="telegram,cve_2026_94488,">
  <rule id="100001" level="12">
    <decoded_as>json</decoded_as>
    <field name="file.path">\.html$</field>
    <field name="file.path">Telegram</field>
    <field name="file.content">(?i)(<script|onerror|onload|javascript:)</field>
    <description>CVE-2026-94488: Suspicious Telegram Desktop HTML export containing XSS payload</description>
    <mitre>
      <id>T1204.002</id>
    </mitre>
    <group>cve_2026_94488,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Avoid using the HTML export feature in Telegram Desktop until an official patch is applied.
   • If HTML export is necessary, open exported HTML files only in a hardened, isolated browser environment (e.g., sandboxed browser or virtual machine) with script execution disabled.
   • Educate users about the risk of opening exported HTML files from untrusted chats, especially those containing forwarded messages with buttons.
   • Consider using alternative export formats (e.g., JSON) that may not be affected.

2. Patch/Upgrade Steps:

   • Upgrade Telegram Desktop to version 7.0.1 or later, which is the first fixed stable version. Version 6.9.4 also contains a fix but 7.0.1 is the recommended stable release.
   • Monitor official Telegram Desktop release channels for security advisories.

3. Long-term Hardening:

   • Implement application allowlisting to prevent unvetted Telegram Desktop versions from running.
   • Deploy endpoint detection rules to monitor for creation of HTML export files with suspicious content.
   • Conduct regular security awareness training on the risks of opening exported or forwarded content.
   • Consider network-level controls to block known malicious payload delivery if applicable.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-94488
• Telegram Desktop Official Website: https://desktop.telegram.org/
• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• MITRE ATT&CK T1204.002: https://attack.mitre.org/techniques/T1204/002/
• CVSS 3.1 Specification: https://www.first.org/cvss/v3.1/specification-document

No known threat actor campaigns or exploit-in-the-wild evidence available at this time.