CVE-2026-73031
telegram-search contains a stored cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript in victims' browsers by sending crafted messages containing unsanitized HTML to a shared Telegram group. The highlightKeyword function in MessageList.vue passes raw message content directly to v-html without HTML escaping or sanitization, enabling stored, cross-user, zero-click execution of injected payloads such as image onerror handlers when victims browse or search messages.
Schwachstellenklasse
telegram-search contains a stored cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript in victims' browsers by sending crafted messages containing unsanitized HTML to a shared Telegram group. The highlightKeyword function in MessageList.vue passes raw message content directly to v-html without HTML escaping or sanitization, enabling stored, cross-user, zero-click execution of injected payloads such as image onerror handlers when victims browse or search messages.
Quellen
- https://github.com/GramSearch/telegram-search
- https://github.com/GramSearch/telegram-search/issues/653
- https://github.com/GramSearch/telegram-search/pull/654
- https://github.com/groupultra/telegram-search/commit/54f6adced844ce9990228d75e31348bfed934e05
- https://www.vulncheck.com/advisories/telegram-search-stored-xss-via-v-html-in-messagelist-vue
Finden Sie die Schwachstelle, bevor es ein Angreifer tut.
Melden Sie sich mit GitHub an und starten Sie Ihr erstes Audit in weniger als einer Minute. Für den kostenlosen Plan ist keine Kreditkarte nötig.