Telegram Desktop contains an input‑validation flaw in its HTML export function that allows an attacker to inject malicious JavaScript into an exported file. The vulnerability resides in the conversion of button text to UTF‑8 within export_output_html.cpp and satisfies CWE‑79. When a message containing attacker‑controlled script is processed by the exporter, the resulting HTML file includes executable code that can run when the file is opened in a browser or any application that renders HTML, potentially exposing the victim’s credentials or enabling other local attacks.

Telegram Desktop releases older than 7.0.1 are affected, including all 6.x versions up through 6.9.4 and any earlier branches. The first stable release to contain the fix is version 7.0.1, which removes the vulnerable logic. Users on the 6.x line should patch to at least 7.0.1 to eliminate the flaw.

The CVSS score of 8.3 indicates a high‑severity flaw, yet exploitation requires the victim to export a chat that contains malicious content. Attackers can disseminate the payload by forwarding a crafted message into a group, after which a group member can export the chat to a local HTML file. Because the trigger is a local export action and no network‑only vector exists, the risk of widespread deployment is limited, but the vulnerability remains a serious threat for users who rely on the export feature. The EPSS score is unavailable and the flaw is not listed in the CISA KEV catalog, so organisations should treat it as a timely CVE and update promptly if they use the exporter feature.