VulnSocial

CVE-2026-94488Patch

LOWCVSS 8.3 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. (The first fixed stable version is 7.0.1.) This occurs in button.text.toUtf8 in export_output_html.cpp. Exploitation cannot occur unless HTML export was used by a victim. However, the exploit payload can be exported if a message were forwarded into a group by a member (it is not necessary for the message author to be a member of a group).

Back to dashboard
2.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 6 mentions across 4 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 3 signals
  • Patch or workaround mentioned in 6 signals
  • Technical details provided in 6 signals
  • Peaked 2d ago at 3 mentions (2026-09-22); latest day: 1
  • 6 total mentions across 4 days

Deep dive

Activity timeline6 mentions / 4d
01223Mentions · 2026-09-21: 1Mentions · 2026-09-22: 3Mentions · 2026-10-15: 1Mentions · 2026-10-29: 1PoC Mentioned / Linked · 2026-09-22: 3Patch / Workaround · 2026-09-21: 1Patch / Workaround · 2026-09-22: 3Patch / Workaround · 2026-10-15: 1Patch / Workaround · 2026-10-29: 1Technical Details · 2026-09-21: 1Technical Details · 2026-09-22: 3Technical Details · 2026-10-15: 1Technical Details · 2026-10-29: 109-2109-2210-1510-29
Signal classification2 categories
Patch
583.3%
PoC
116.7%
Referenced assets6 URLs
Classification over time
DateTotalLabels
2026-09-211
Patch1
2026-09-223
Patch2PoC1
2026-10-151
Patch1
2026-10-291
Patch1
Full discourse6 posts
  • VulnTracker@vuln_tracker
    Patch

    A forwarded Telegram message can carry a hidden XSS payload into your HTML export (CVSS 8.2). CVE-2026-94488 sits in Telegram Desktop's HTML exporter. The exploit only fires when a victim exports a chat to HTML, but the payload can ride in through a forwarded message, no group membership required. Proof-of-concept exploit code is already public. Fixed in Telegram Desktop 7.0.1. Update now. Details: http://vulntracker.io/cves/CVE-2026-94488 #Telegram #CVE #XSS #InfoSec #CyberSecurity

    Post summary

    Telegram Desktop HTML exporter XSS (CVE-2026-94488, CVSS 8.2) via forwarded messages with public PoC; fixed in version 7.0.1 with explicit update directive.

    02041310
    832 followersView on X
  • Ryx@PadhiyarRushi
    Patch

    Telegram Desktop HTML exporter XSS!!! CVE-2026-94488: XSS in the HTML exporter path (button.text.toUtf8 in export_output_html.cpp) affecting builds before 6.9.4 (fixed stable path noted as 7.0.1). Client-side, but still a clean parser bug class. https://www.thehackerwire.com/vulnerability/CVE-2026-94488/ #Cybersecurity #AI #AISecurity #MCP #Claude #GPT #Infosec #Trending #AppSec #XSS

    Post summary

    The post announces CVE-2026-94488, an XSS in Telegram Desktop's HTML exporter, and notes a fixed version (7.0.1). A link to vulnerability details is provided but no exploit tool or active exploitation evidence is mentioned.

    11022467
    954 followersView on X
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Patch

    CVE-2026-94488 Telegram Desktop XSS in HTML exporter, CVSS 8.2. Fixed in 7.0.1, no patch cleared yet. Update now if you use HTML export. https://www.valtersit.com/cve/CVE-2026-94488 #CVE #infosec #Telegram #Telegram #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker

    Post summary

    The tweet discloses CVE-2026-94488, an XSS vulnerability in Telegram Desktop's HTML exporter with CVSS 8.2, notes it is fixed in version 7.0.1, and urges users to update. The primary focus is on the available fix.

    0002032
    1.1K followersView on X
  • CVE@CVEnew
    Patch

    CVE-2026-94488 Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. (The first fixed stable version is 7.0.1.) This occurs in button.text.toUtf8 in export_output_html.cpp.… https://www.cve.org/CVERecord?id=CVE-2026-94488

    Post summary

    The text discloses a cross-site scripting (XSS) vulnerability in Telegram Desktop before version 6.9.4 and explicitly mentions the patched version (7.0.1) as remediation.

    10001829
    58.1K followersView on X
  • ngCERT@ngCERTofficial
    Patch

    🚨 CRITICAL: CVE-2026-94488 A bot’s inline button text that runs when the HTML file is opened in a browser could carry JavaScript into an exported chat. Update to 7.0.1+ Read full advisory on our website https://cert.gov.ng/advisories/telegram-desktop-stored-cross-site-scripting-xss-vulnerability #InfoSec #XSS #Telegram #CyberSecurity https://t.co/wfDRceekNI

    Post summary

    CVE-2026-94488, a critical stored XSS flaw in Telegram Desktop, is disclosed with a required update to version 7.0.1+.

    01000147
    1.4K followersView on X
  • Hephaestvs@Vulcanux_
    PoC

    csirt_it: ‼️ #PoC #Telegram: Disponibile Proof of Concept (PoC) per la vulnerabilità identificata dalla CVE-2026-94488 in Telegram Desktop Rischio: 🔴 Tipologia: 🔸 Security Feature Bypass 🔗 https://www.acn.gov.it/portale/w/telegram-desktop-poc-pubblica-per-lo-sfruttamento-della-cve-2026-94488 ⚠️ Importante mantenere aggiornati… https://t.co/tyARGhIC1s

    Post summary

    The post announces that a public Proof of Concept is available for CVE-2026-94488 in Telegram Desktop and describes the issue as a high-risk Security Feature Bypass. It also advises keeping software updated, but the central takeaway is the PoC availability.

    00000104
    638 followersView on X

Explore more

Back to dashboard