CVE-2026-94488

Name of the Vulnerable Software and Affected Versions Telegram Desktop versions prior to 7.0.1

Description Cross-site scripting (XSS) is possible within the HTML exporter. This issue occurs in the button.text.toUtf8 function located in export output html.cpp. Exploitation requires the victim to use the HTML export feature. An exploit payload can be exported if a message is forwarded into a group by a member, regardless of whether the original author of the message is a group member.

Recommendations Update Telegram Desktop to version 7.0.1 or later.