Telegram Desktop exports made before July 14 still carry a bot's injected JavaScript
ExPatch says Telegram Desktop wrote bot button text into HTML chat exports without escaping it from March 2024 until a July fix, and updating the app leaves every file the earlier builds wrote unchanged on disk.
The Watch · Security desk
What happened
- ExPatch researchers Denis Rostilov and Aleksander Rostilov published a writeup on September 12 on a Telegram Desktop flaw that let a bot plant hidden JavaScript in chats users exported to HTML.
- Opening an affected export in a browser ran the script with no further click, and it could copy that file's messages, sender names, timestamps, chat name, member count and local path to the attacker's server.
- The update escapes new exports and does not touch files written by earlier versions, so HTML exports made before the fix still carry the script.
- The researchers scored the flaw 8.2 out of 10 on CVSS 3.1, and as of September 14 neither Telegram nor the U.S. National Vulnerability Database had published a score of its own.
Why it matters
- Who's exposed exposure Patching the client cleans nothing already on disk, so an organisation holding HTML exports has to remediate file by file, and the sorting key is which client version wrote each one.
- What's now possible capability Because a forwarded web-link button keeps its payload, a group that never added a bot can still hold one, so checking a chat's bot membership does not clear its exports.
- What it limits constraint An export kept as evidence or a compliance record can be rewritten in the browser at display time while the bytes on disk stay as written, which limits what a pre-July HTML file can be used to prove.
- Who has to decide decision Owners of old archives now choose between re-exporting every chat from Telegram's intact copy and reading the existing files with scripting switched off.
Next story · Build · yesterday
Claude Code Desktop's preview pane ran scripts in HTML files over 256KBConfirmed2 publishers
The export escaped message text, sender names and other fields [6]. It did not escape the text a bot chooses for the buttons under its own message [5]. A bot could put a script tag in that button text and pad it with invisible characters; in the build the researchers tested, the button then looked empty [7].
The bot does not have to be in the chat it targets. A message whose only buttons are web links keeps those buttons when it is forwarded, so any member who forwards the bot's message into a group brings the script with it [8]. From there the message sits in the history like any other until someone deletes it, and the export can be taken months or years later [9].
The researchers reported to Telegram on June 3, two days after finding the bug [2]. Commit 8457d13a by Telegram Desktop developer John Preston was written on June 30, 27 days later, and the escaping reached stable in 7.0.1 on July 14, 41 days after the report [3][24]. The unescaped line had been in stable releases since 4.15.1 in March 2024, roughly 28 months of exports written by vulnerable code [16][23].
The take from one file is bounded. Telegram Desktop splits long exports into files of 1,000 messages, and the script reads only the file it sits in, not the whole chat or the account [12]. What it can send is everything in that file: messages, sender names, timestamps, the chat's name, type and member count, and the local file path [11].
The script could also rewrite what the page showed. In the researchers' demonstration it replaced the whole export with a fake Telegram "verification" form [13]. The same control can change dates, senders or message text in a file being kept as a record, and neither Telegram's own copy of the chat nor the export file on disk was altered [14].
Whether an archive holds a carrier depends on how the export was made. Exporting a single chat from its menu includes every member's messages, while a full-account export includes by default only the owner's own messages in groups and channels, plus all messages in one-to-one chats and chats with bots [21].
The researchers looked at Telegram Desktop's HTML export and did not examine the JSON export format or the export features of Telegram's other apps [20]. They tested on their own accounts and test groups, and their writeup does not claim the flaw has been used against real users [22]. Their advice is to update to 7.0.1 or later, or 6.9.4 or later on the beta channel, and then re-export any chat that was exported to HTML before the fix [18]. Opening an old export with JavaScript turned off breaks the third precondition, and the script does not run [19][25].
What to watch
- A CVE identifier or an NVD entry with a vendor score, which would give defenders something to weigh against the researchers' 8.2.
- Whether the JSON export path, or the export features in Telegram's mobile and web apps, write the same field unescaped.
- Any report of the injected script turning up in an export outside the researchers' own test accounts.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+10
- Incentives45
- Confidence72
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Security researchers at ExPatch, Denis Rostilov and Aleksander Rostilov, published a writeup on September 12 describing a Telegram Desktop flaw that let a bot's message plant hidden JavaScript inside chats users exported to HTML files.
- [2]
The researchers reported the flaw to Telegram on June 3, two days after finding it.
- [3]
The fix, commit 8457d13a by Telegram Desktop developer John Preston, adds the missing escaping; it was written on June 30 and reached the 6.9.4 beta on July 3 and the 7.0.1 stable release on July 14, the first fixed versions published on GitHub.
- [4]
Affected versions are Telegram Desktop 4.15.1 (March 2024) through 6.9.3; fixed versions are 6.9.4 beta (July 3, 2026), 7.0.1 (July 14, 2026) and later.
- [5]
Until the fix, Telegram Desktop's export code wrote a bot's inline keyboard button text directly into the HTML page without escaping it.
- [6]
The export applied escaping to message text, sender names, and other fields.
- [7]
A bot could put a script tag in a button's text, padded with invisible characters so that the button looked empty in the Telegram Desktop build the researchers tested.
- [8]
The bot does not need to be in the chat it targets: a message whose only buttons are web links keeps those buttons when it is forwarded, so any member who forwards the bot's message into a group carries the script with it.
- [9]
The message then sits in the chat's history like any other until it is deleted, and can be exported months or years later.
- [10]
When an export file containing the message was opened, the script ran without any further click, the researchers said.
- [11]
The script could read every message in that file, including sender names and timestamps, the chat's name, type, and member count, and the local file path, and send them all to the attacker's server.
- [12]
Telegram Desktop's export code splits long exports into files of 1,000 messages each, so one file exposes at most its own contents, not the whole chat or the Telegram account.
- [13]
The script could also rewrite the page; in the researchers' demonstration it replaced the whole export with a fake Telegram "verification" form.
- [14]
The same control could change dates, senders, or message text in a file being used as a record, and it did not change Telegram's own copy of the chat or the export file saved on disk.
- [15]
Telegram shipped a fix in July, but the app update does not update files exported with earlier versions, so old HTML exports can still carry the script.
- [16]
The unescaped line had been in stable releases since 4.15.1 in March 2024, about two years and four months.
- [17]
The researchers rated the flaw 8.2 out of 10 on the CVSS 3.1 scale, and no score from Telegram or from the U.S. National Vulnerability Database exists as of September 14.
- [18]
The researchers advise updating Telegram Desktop to 7.0.1 or later, or to 6.9.4 or later on the beta channel, and after updating exporting again any chats that were exported to HTML before the fix.
- [19]
Three things had to be true for the script to run: the HTML export was made using a Telegram Desktop version before the fix, the message carrying the script fell within the exported chat, and the file was opened in a browser with JavaScript enabled.
- [20]
The researchers examined only Telegram Desktop's HTML export and did not address the JSON export format or the export features of Telegram's other apps.
- [21]
Exporting a single chat from its menu includes every member's messages, while a full-account export includes by default only the account owner's own messages in groups and channels, but all messages in one-to-one chats and chats with bots, according to the export code and Telegram's documentation.
- [22]
The researchers say they tested the flaw only on their own accounts and test groups, and their writeup does not claim that anyone has used it against real users.
- [23]
Vulnerable stable builds wrote HTML exports for about 28 months, from March 2024 to the July 14 fix.
- [24]
The patch commit came 27 days after the June 3 report, and the 7.0.1 stable release came 41 days after it.
- [25]
Opening an old export in a browser with JavaScript disabled fails one of the three stated preconditions, so the script does not run.
Sources
2 independent publishers whose own reporting we read for this story.
- securityaffairs.comTelegram Desktop Flaw Could Turn Old Chat Exports Into Data Theft Traps
1 article · September 15, 2026
- thehackernews.comTelegram Desktop Flaw Lets Hidden JavaScript Exfiltrate Messages From HTML Exports
2 articles · September 15, 2026
Topics and entities
Topics
- Cross-Site Scripting
- Vulnerability Disclosure
- Consumer messaging app security
Entities
- Aleksander Rostilov
- CVSS
- Telegram Desktop
- Telegram
- National Vulnerability Database