CVE-2026-73031

Name of the Vulnerable Software and Affected Versions telegram-search (affected versions not specified)

Description A stored cross-site scripting issue exists that allows remote attackers to execute arbitrary JavaScript in the browsers of other users. This occurs when crafted messages containing unsanitized HTML are sent to a shared Telegram group. Specifically, the highlightKeyword() function in MessageList.vue passes raw message content directly to v-html without proper HTML escaping or sanitization. This enables zero-click execution of injected payloads, such as image onerror handlers, when victims browse or search for messages.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.