Telegram Desktop exports made before July 14 still carry a bot's injected JavaScript

The export escaped message text, sender names and other fields ^[3]. It did not escape the text a bot chooses for the buttons under its own message ^[2]. A bot could put a script tag in that button text and pad it with invisible characters; in the build the researchers tested, the button then looked empty ^[4].

The bot does not have to be in the chat it targets. A message whose only buttons are web links keeps those buttons when it is forwarded, so any member who forwards the bot's message into a group brings the script with it ^[5]. From there the message sits in the history like any other until someone deletes it, and the export can be taken months or years later ^[6].

The researchers reported to Telegram on June 3, two days after finding the bug ^[13]. Commit 8457d13a by Telegram Desktop developer John Preston was written on June 30, 27 days later, and the escaping reached stable in 7.0.1 on July 14, 41 days after the report ^[14][23]. The unescaped line had been in stable releases since 4.15.1 in March 2024, roughly 28 months of exports written by vulnerable code ^[15][24].

The take from one file is bounded. Telegram Desktop splits long exports into files of 1,000 messages, and the script reads only the file it sits in, not the whole chat or the account ^[9]. What it can send is everything in that file: messages, sender names, timestamps, the chat's name, type and member count, and the local file path ^[8].

The script could also rewrite what the page showed. In the researchers' demonstration it replaced the whole export with a fake Telegram "verification" form ^[10]. The same control can change dates, senders or message text in a file being kept as a record, and neither Telegram's own copy of the chat nor the export file on disk was altered ^[11].

Whether an archive holds a carrier depends on how the export was made. Exporting a single chat from its menu includes every member's messages, while a full-account export includes by default only the owner's own messages in groups and channels, plus all messages in one-to-one chats and chats with bots ^[20].

The researchers looked at Telegram Desktop's HTML export and did not examine the JSON export format or the export features of Telegram's other apps ^[19]. They tested on their own accounts and test groups, and their writeup does not claim the flaw has been used against real users ^[21]. Their advice is to update to 7.0.1 or later, or 6.9.4 or later on the beta channel, and then re-export any chat that was exported to HTML before the fix ^[22]. Opening an old export with JavaScript turned off breaks the third precondition, and the script does not run ^[18][25].