CVE-2026-73031
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
telegram-search contains a stored cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript in victims' browsers by sending crafted messages containing unsanitized HTML to a shared Telegram group. The highlightKeyword function in MessageList.vue passes raw message content directly to v-html without HTML escaping or sanitization, enabling stored, cross-user, zero-click execution of injected payloads such as image onerror handlers when victims browse or search messages.
Risk Assessment
An attacker can hijack user sessions, steal data, or spread malicious content within the Telegram group, potentially leading to confidentiality and integrity breaches.
Recommendation
It is recommended to immediately update telegram-search to a patched version and implement HTML sanitization for all user input before using v-html.
Original NVD description (English source)
telegram-search contains a stored cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript in victims' browsers by sending crafted messages containing unsanitized HTML to a shared Telegram group. The highlightKeyword function in MessageList.vue passes raw message content directly to v-html without HTML escaping or sanitization, enabling stored, cross-user, zero-click execution of injected payloads such as image onerror handlers when victims browse or search messages.