Telegram Desktop Flaw Lets Hidden Java Script Exfiltrate Messages From HTML Exports

Summary: Researchers at ExPatch reported on September 12 that a Telegram Desktop flaw let a bot's message carry hidden JavaScript into chats exported as HTML, running when the file was opened in a browser and copying every message in it to an attacker-controlled server. Telegram fixed the missing escaping in commit 8457d13a, which reached the 7.0.1 stable release on July 14, but exports made with earlier versions still carry the script, and the unescaped line had been in stable releases since 4.15.1 in March 2024.
What's compelling: Any HTML export made before the fix is a record that can rewrite its own dates, senders, and message text when opened, and Telegram has published no guidance for users holding those files and no CVE exists for the flaw.

Read the original at The Hacker News ↗