CVE-2026-94488
- Source
- https://cve.org/CVERecord?id=CVE-2026-94488
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-94488.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-94488
- Downstream
- Published
- 2026-09-21T17:29:01Z
- Modified
- 2026-10-28T11:19:52Z
- Severity
-
- 8.3 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- [none]
- Details
-
Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. (The first fixed stable version is 7.0.1.) This occurs in button.text.toUtf8 in export_output_html.cpp. Exploitation cannot occur unless HTML export was used by a victim. However, the exploit payload can be exported if a message were forwarded into a group by a member (it is not necessary for the message author to be a member of a group).
- Database specific
{ "cna_assigner": "mitre", "cwe_ids": [ "CWE-79" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/94xxx/CVE-2026-94488.json" }- References
-
- https://github.com/telegramdesktop/tdesktop/blob/v6.9.3/Telegram/SourceFiles/export/output/export_output_html.cpp
- https://thehackernews.com/2026/09/telegram-desktop-flaw-lets-hidden.html
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/94xxx/CVE-2026-94488.json
- https://github.com/telegramdesktop/tdesktop/releases/tag/v6.9.4
- https://nvd.nist.gov/vuln/detail/CVE-2026-94488
- https://github.com/telegramdesktop/tdesktop/commit/52c779bffa8dde3c5c09826add2607328fae0924
- https://github.com/telegramdesktop/tdesktop/commit/8457d13aa795fadf99c955d2a04f00ebc3c59df9
- https://github.com/telegramdesktop/tdesktop
- https://expatch.com/writeups/telegram-html-export-xss.html
Affected packages
Git / github.com/telegramdesktop/tdesktop
Affected ranges
- Type
- GIT
- Repo
- https://github.com/telegramdesktop/tdesktop
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "4.15.1" }, { "fixed": "6.9.4" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" }, { "range": [ { "fixed": "8457d13aa795fadf99c955d2a04f00ebc3c59df9" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "52c779bffa8dde3c5c09826add2607328fae0924" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v6.9.4", "range": [ { "fixed": "8a22f2c106dd3c601e11d124b8d1894613d596fd" } ], "source": "REFERENCES_TAG" } ] }
Affected versions
v4.*
v4.15.1
v4.15.2
v4.15.3
v4.15.4
v4.15.5
v4.15.6
v4.15.7
v4.16.0
v4.16.1
v4.16.10
v4.16.2
v4.16.3
v4.16.4
v4.16.5
v4.16.6
v4.16.7
v4.16.8
v4.16.9
v5.*
v5.0.0
v5.0.1
v5.0.2
v5.0.3
v5.0.4
v5.0.5
v5.0.6
v5.1.0
v5.1.1
v5.1.2
v5.1.3
v5.1.4
v5.1.5
v5.1.6
v5.1.7
v5.1.8
v5.10.0
v5.10.1
v5.10.2
v5.10.3
v5.10.4
v5.10.5
v5.10.6
v5.10.7
v5.11.0
v5.11.1
v5.12.0
v5.12.1
v5.12.2
v5.12.3
v5.12.4
v5.12.5
v5.12.6
v5.13.0
v5.13.1
v5.14.0
v5.14.1
v5.14.2
v5.14.3
v5.15.0
v5.15.1
v5.15.2
v5.15.3
v5.15.4
v5.16.0
v5.16.1
v5.16.2
v5.16.3
v5.16.4
v5.16.5
v5.16.6
v5.2.0
v5.2.1
v5.2.2
v5.2.3
v5.2.4
v5.2.5
v5.2.6
v5.3.0
v5.3.1
v5.3.2
v5.4.0
v5.4.1
v5.4.2
v5.4.3
v5.4.4
v5.4.5
v5.4.6
v5.5.0
v5.5.1
v5.5.2
v5.5.3
v5.5.4
v5.5.5
v5.5.6
v5.5.7
v5.5.8
v5.6.0
v5.6.1
v5.6.2
v5.6.3
v5.6.4
v5.7.0
v5.7.1
v5.7.2
v5.7.3
v5.7.4
v5.8.0
v5.8.1
v5.8.2
v5.8.3
v5.8.4
v5.8.5
v5.9.0
v5.9.1
v5.9.2
v6.*
v6.0.0
v6.0.1
v6.0.2
v6.0.3
v6.1.0
v6.1.1
v6.1.2
v6.1.3
v6.1.4
v6.2.0
v6.2.2
v6.2.3
v6.2.4
v6.2.5
v6.2.6
v6.3.0
v6.3.1
v6.3.10
v6.3.2
v6.3.3
v6.3.4
v6.3.6
v6.3.7
v6.3.8
v6.3.9
v6.4.0
v6.4.1
v6.4.2
v6.4.3
v6.4.4
v6.5.0
v6.5.1
v6.6.0
v6.6.1
v6.6.2
v6.6.3
v6.6.4
v6.7.0
v6.7.1
v6.7.2
v6.7.3
v6.7.4
v6.7.5
v6.7.6
v6.7.7
v6.7.8
v6.8.0
v6.8.1
v6.8.2
v6.8.3
v6.8.4
v6.8.5
v6.9.0
v6.9.1
v6.9.2
v6.9.3
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-94488.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"88157941751205365930181352695182181688",
"112601132109801500422354155527761692061",
"37460936380132199035440955257188920232",
"66851554444049239811503967919628445295"
],
"threshold": 0.9
},
"id": "CVE-2026-94488-213e8c73",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/telegramdesktop/tdesktop/commit/52c779bffa8dde3c5c09826add2607328fae0924",
"target": {
"file": "Telegram/SourceFiles/export/output/export_output_html.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"148793455127580260450768750625854902649",
"248678431830316809218842481081802404818",
"119883193551603313632583862650131086770",
"75594760226781091825391101682945896074",
"161075818438154606379566781888906891096",
"303601418153512685617780286952626078226",
"267018344572721235663101631688203454219",
"236148823538378573991599431557124879963",
"18093095921233054226768916216375698671",
"280670661296863460433434773648750637176",
"247109006676989106562917624780613992423",
"197406941229525162986833606833096995210",
"183915063721363433788717446380318131565",
"127878599869107790507787235976329317223",
"141586533680366295890842094809397346391",
"179526503404929529729435177701929468216",
"187077426619662955991527971559009906728",
"311832821113887359821264867684988826084",
"159195793174137313594736829307202073820",
"178418551276390518756851234328317477316",
"172664692089018914986757247850287319068",
"321753582339720856577965920584248918506",
"227588631040651383253144066825330197185",
"76862072541263064256208022873443306616",
"50747181834409676170900847437386244124",
"323568180816135991511106271908628859836",
"318229422154636667995105136551429935564",
"145413912932305226910128887161902465040",
"153866695417510552869666661136563976289",
"180872621302071283479552684008900866440"
],
"threshold": 0.9
},
"id": "CVE-2026-94488-46ff7cb1",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/telegramdesktop/tdesktop/commit/52c779bffa8dde3c5c09826add2607328fae0924",
"target": {
"file": "Telegram/SourceFiles/export/output/export_output_json.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"253263684813640432304753215400869999887",
"307258159338320111887903091864826546308",
"291351257146993756648909768622189984103",
"69482268838652815776154021532910706589"
],
"threshold": 0.9
},
"id": "CVE-2026-94488-b8292e24",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/telegramdesktop/tdesktop/commit/8a22f2c106dd3c601e11d124b8d1894613d596fd",
"target": {
"file": "Telegram/SourceFiles/core/version.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"180526852788798598043926150568854021716",
"132658137102705857324076394914733520390",
"113973402627609326742384512395934840588"
],
"threshold": 0.9
},
"id": "CVE-2026-94488-e40976f0",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/telegramdesktop/tdesktop/commit/52c779bffa8dde3c5c09826add2607328fae0924",
"target": {
"file": "Telegram/SourceFiles/export/data/export_data_types.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"213769417583986172828983625911958148685",
"317575235172830164700276311746016259818",
"221361363249424695071483622218375343873"
],
"threshold": 0.9
},
"id": "CVE-2026-94488-f0e3993e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/telegramdesktop/tdesktop/commit/52c779bffa8dde3c5c09826add2607328fae0924",
"target": {
"file": "Telegram/SourceFiles/export/data/export_data_types.h"
}
}
]
vanir_signatures_modified
"2026-10-28T11:19:52Z"