Cross-Site Scripting Vulnerability in Telegram Desktop by Telegram
CVE-2026-94488

8.3HIGH

Key Information:

Vendor: Telegram
Status: Telegram Desktop
Vendor: CVE Published:; 21 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-94488?

A cross-site scripting vulnerability exists in Telegram Desktop prior to version 6.9.4, allowing attackers to exploit the HTML export functionality. The issue is present in the method button.text.toUtf8 within export_output_html.cpp. An attacker must entice a victim to utilize the HTML export feature to trigger the vulnerability. However, if a message containing the exploit payload is forwarded by any user, it may lead to unintended execution. A patch for this vulnerability was introduced in version 7.0.1, enhancing the security of the application.

Affected Version(s)

Telegram Desktop Windows 4.15.1 < 6.9.4

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-94488 - Proof of Concept