Telegram Desktop Pre-7.0.1 Export Code Allowed Bot-Injected JavaScript in HTML Files

The vulnerability stemmed from Telegram Desktop's HTML export routine writing bot button text directly into the DOM without escaping. Researchers Denis and Aleksander Rostilov demonstrated that a script tag placed in button text, padded with zero-width characters, survived forwarding and sat dormant in chat history until export. The script executed with no user interaction beyond opening the file, exfiltrating message contents, metadata, and local paths while the export remained unaltered on disk.

Telegram's own GitHub commit 8457d13a, merged June 30 and shipped in 7.0.1, added the missing escaping. No CVE was assigned and NVD shows no entry as of September 14. The flaw required three conditions: an unpatched export, a forwarded bot message inside the exported range, and JavaScript-enabled browser viewing. Old exported files retain the payload indefinitely.

This pattern matches prior messenger export weaknesses where sanitization was applied only to visible UI elements rather than serialized output. Full-account exports default to owner messages only in groups, limiting blast radius, yet one-to-one and bot chats expose everything. No independent confirmation of in-the-wild exploitation exists beyond the researchers' controlled tests.

Forwarded bot messages carrying the payload can persist for years. Future audits should target JSON export paths and mobile export functions, which the researchers did not examine.