Telegram Desktop vulnerabilities

2 known vulnerabilities in Telegram Desktop from Telegram. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  Telegram Desktop: Improper Neutralization of Record Delimiters

  CVE-2026-107181Oct 7, 2026Telegram

  Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme hand

• 8.2 High severity

  Telegram Desktop: Improper Neutralization of Input During Web Page Generation

  CVE-2026-94488Sep 21, 2026Telegram

  Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. (The first fixed stable version is 7.0.1.) This occurs in button.text.toUtf8 in export_output_html.cpp. Exploitation cannot occur unless HTML export was used by a victim. However, the exploit paylo