A security flaw in Telegram Desktop could have allowed a malicious bot message to hide JavaScript inside a chat and execute it when the conversation was later exported as an HTML file, according to security researchers at ExPatch. The researchers disclosed details of the issue on September 12, after Telegram had already released a fix in July.
The problem affected Telegram Desktop, the Windows, macOS, and Linux app that allows users to export individual chats or entire accounts as HTML pages that can be opened in a web browser. The researchers found that a bot could place malicious JavaScript inside the text of an inline keyboard button attached to a message. The message could look completely normal inside Telegram, while the hidden code would only become dangerous when the exported HTML file was opened in a browser.
Telegram’s export system properly escaped message text, sender names and other information before placing them into an HTML file, but the same protection was missing from the text used for inline keyboard buttons. This meant a bot could insert a script tag into a button’s text and hide it using invisible characters, making the malicious content difficult to notice in Telegram Desktop.
The attack also did not require the bot to be a member of the targeted conversation. According to the researchers, a message containing only web-link buttons could retain those buttons when forwarded into another group. Once forwarded, the message could remain in the chat history until someone eventually exported the conversation, potentially months or even years later.
When an affected HTML export was opened in a browser with JavaScript enabled, the hidden script could run automatically without requiring another click. In the researchers’ testing, it could read messages contained in that particular exported file, including sender names, timestamps, chat information and the local file path, and transmit the collected information to an attacker-controlled server.
The researchers also demonstrated that the script could modify what users saw on the exported page. In one example, the legitimate Telegram export was replaced with a fake verification form. The same technique could potentially alter message text, sender names or dates displayed in an exported record. However, the researchers noted that this would not change the original Telegram conversation or the HTML file stored on the user’s computer.
There were limits to what an attacker could access. Telegram Desktop divides large HTML exports into separate files containing up to 1,000 messages each, meaning a malicious script could access only the messages contained in the specific file where it was executed rather than automatically gaining access to an entire Telegram account.
The researchers rated the vulnerability 8.2 out of 10 using the CVSS 3.1 scoring system. They said the flaw required three conditions: the HTML export had to be created using a vulnerable version of Telegram Desktop, the malicious message had to be included in the exported chat, and the resulting file had to be opened in a browser with JavaScript enabled.
Telegram was informed about the vulnerability on June 3, just two days after the researchers discovered it. They said their testing was limited to their own accounts and test groups, and their disclosure does not claim that the vulnerability was exploited against real users.
Telegram fixed the underlying issue by adding the missing HTML escaping to its export code. The fix was included in the 6.9.4 beta release on July 3 and reached the stable 7.0.1 release on July 14. Versions 7.0.1 and later are therefore protected against the specific flaw described by the researchers.
The vulnerability had been present in stable Telegram Desktop releases since version 4.15.1, released in March 2024. That means the unsafe export behavior remained in stable versions for more than two years before being corrected.
For users who created HTML exports with an older version of Telegram Desktop, simply updating the application does not automatically make those existing files safe. The researchers recommend exporting affected chats again after updating. They also advise users to treat old HTML exports as untrusted and, if necessary, open them only with JavaScript disabled.
The researchers said Telegram had not published specific guidance for users who already have older HTML exports as of September 14. They also noted that the issue concerns Telegram Desktop’s HTML export functionality and did not cover JSON exports or export features in Telegram’s other applications.
The vulnerability does not have a CVE identifier, and the researchers said Telegram’s release notes and changelog did not mention the security fix. Telegram’s GitHub repository also had no security advisory for the issue at the time of their disclosure.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
According to the researchers, Telegram confirmed the vulnerability on July 1 and offered a $500 bug bounty, which they declined and asked to have donated to charity. They also requested coordinated disclosure and waited until after the fix had been released before publishing their findings on September 12.
