telegram-search implements a stored cross‑site scripting flaw in the MessageList.vue component by passing unescaped message content directly to the Vue v‑html binding. This satisfies CWE‑79, allowing an attacker to embed any JavaScript payload that will run in the victim’s browser. The attacker can thus hijack sessions, exfiltrate data, or perform other malicious client‑side actions. Because the payload is stored, it executes with each visit to the shared Telegram group or search operation, providing a zero‑click vector for the victim.

The vulnerability is present in the GramSearch:telegram-search application. No specific version information is supplied, so any deployed instance may be susceptible until a patch is applied.

The CVSS score of 8.2 indicates a high severity flaw. The EPSS score of less than 1% suggests exploitation is unlikely at this time, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. Attackers could send a crafted message to a shared Telegram group; any user who scrolls or searches the group’s messages would automatically trigger the malicious code without interaction.