CVE-2026-94488

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-94488

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-94488.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-94488

Downstream

DEBIAN-CVE-2026-94488

Published

2026-09-21T17:29:01Z

Modified

2026-09-24T08:22:24Z

Severity

8.3 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

[none]

Details

Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. (The first fixed stable version is 7.0.1.) This occurs in button.text.toUtf8 in export_output_html.cpp. Exploitation cannot occur unless HTML export was used by a victim. However, the exploit payload can be exported if a message were forwarded into a group by a member (it is not necessary for the message author to be a member of a group).

Database specific

{
    "cna_assigner":  "mitre",
    "cwe_ids":  [
        "CWE-79"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/94xxx/CVE-2026-94488.json"
}

References

Affected packages

Git / github.com/telegramdesktop/tdesktop

Affected ranges

Type

GIT

Repo

https://github.com/telegramdesktop/tdesktop

Events

Introduced

990ae11f6291aa0a9d71007c0cee5e28b68c0c0a

Fixed

8a22f2c106dd3c601e11d124b8d1894613d596fd

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "4.15.1"
        },
        {
            "fixed":  "6.9.4"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v4.*

v4.15.1

v4.15.2

v4.15.3

v4.15.4

v4.15.5

v4.15.6

v4.15.7

v4.16.0

v4.16.1

v4.16.10

v4.16.2

v4.16.3

v4.16.4

v4.16.5

v4.16.6

v4.16.7

v4.16.8

v4.16.9

v5.*

v5.0.0

v5.0.1

v5.0.2

v5.0.3

v5.0.4

v5.0.5

v5.0.6

v5.1.0

v5.1.1

v5.1.2

v5.1.3

v5.1.4

v5.1.5

v5.1.6

v5.1.7

v5.1.8

v5.10.0

v5.10.1

v5.10.2

v5.10.3

v5.10.4

v5.10.5

v5.10.6

v5.10.7

v5.11.0

v5.11.1

v5.12.0

v5.12.1

v5.12.2

v5.12.3

v5.12.4

v5.12.5

v5.12.6

v5.13.0

v5.13.1

v5.14.0

v5.14.1

v5.14.2

v5.14.3

v5.15.0

v5.15.1

v5.15.2

v5.15.3

v5.15.4

v5.16.0

v5.16.1

v5.16.2

v5.16.3

v5.16.4

v5.16.5

v5.16.6

v5.2.0

v5.2.1

v5.2.2

v5.2.3

v5.2.4

v5.2.5

v5.2.6

v5.3.0

v5.3.1

v5.3.2

v5.4.0

v5.4.1

v5.4.2

v5.4.3

v5.4.4

v5.4.5

v5.4.6

v5.5.0

v5.5.1

v5.5.2

v5.5.3

v5.5.4

v5.5.5

v5.5.6

v5.5.7

v5.5.8

v5.6.0

v5.6.1

v5.6.2

v5.6.3

v5.6.4

v5.7.0

v5.7.1

v5.7.2

v5.7.3

v5.7.4

v5.8.0

v5.8.1

v5.8.2

v5.8.3

v5.8.4

v5.8.5

v5.9.0

v5.9.1

v5.9.2

v6.*

v6.0.0

v6.0.1

v6.0.2

v6.0.3

v6.1.0

v6.1.1

v6.1.2

v6.1.3

v6.1.4

v6.2.0

v6.2.2

v6.2.3

v6.2.4

v6.2.5

v6.2.6

v6.3.0

v6.3.1

v6.3.10

v6.3.2

v6.3.3

v6.3.4

v6.3.6

v6.3.7

v6.3.8

v6.3.9

v6.4.0

v6.4.1

v6.4.2

v6.4.3

v6.4.4

v6.5.0

v6.5.1

v6.6.0

v6.6.1

v6.6.2

v6.6.3

v6.6.4

v6.7.0

v6.7.1

v6.7.2

v6.7.3

v6.7.4

v6.7.5

v6.7.6

v6.7.7

v6.7.8

v6.8.0

v6.8.1

v6.8.2

v6.8.3

v6.8.4

v6.8.5

v6.9.0

v6.9.1

v6.9.2

v6.9.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-94488.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "253263684813640432304753215400869999887",
                "307258159338320111887903091864826546308",
                "291351257146993756648909768622189984103",
                "69482268838652815776154021532910706589"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-94488-b8292e24",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/telegramdesktop/tdesktop/commit/8a22f2c106dd3c601e11d124b8d1894613d596fd",
        "target":  {
            "file":  "Telegram/SourceFiles/core/version.h"
        }
    }
]

vanir_signatures_modified

"2026-09-24T08:22:24Z"