Hi,

The following vulnerability was published for telegram-desktop.

CVE-2026-94488[0]:
| Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. (The
| first fixed stable version is 7.0.1.) This occurs in
| button.text.toUtf8 in export_output_html.cpp. Exploitation cannot
| occur unless HTML export was used by a victim. However, the exploit
| payload can be exported if a message were forwarded into a group by
| a member (it is not necessary for the message author to be a member
| of a group).

https://expatch.com/writeups/telegram-html-export-xss.html
https://github.com/telegramdesktop/tdesktop/commit/8457d13aa795fadf99c955d2a04f00ebc3c59df9 (v6.9.4)


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-94488
https://www.cve.org/CVERecord?id=CVE-2026-94488

Please adjust the affected versions in the BTS as needed.

Hello,

Bug #1150329 in telegram-destkop reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/debian/telegram-desktop/-/commit/18e40065dcf41a7ce9f89201fa507dde5f79ee56
------------------------------------------------------------------------
Add 1009-Fix-escaping-in-HTML-export-of-keyboards.patch and 2026-Escape-semicolon-in-socket-command.patch to fix CVE-2026-94488 and CVE-2026-107181 respectively

Closes: #1150328, #1150329
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1150329

We believe that the bug you reported is fixed in the latest version of
telegram-desktop, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1150329@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Nicholas Guriev <guriev-ns@ya.ru> (supplier of updated telegram-desktop package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Thu, 29 Oct 2026 20:55:56 +0300
Source: telegram-desktop
Architecture: source
Version: 5.7.2+ds-6
Distribution: unstable
Urgency: medium
Maintainer: Nicholas Guriev <guriev-ns@ya.ru>
Changed-By: Nicholas Guriev <guriev-ns@ya.ru>
Closes: 1150328 1150329
Changes:
 telegram-desktop (5.7.2+ds-6) unstable; urgency=medium
 .
   * Apply security fixes:
     - Fix escaping in HTML export of keyboards (Closes: #1150329, CVE-2026-94488).
     - Escape semicolon in socket command (Closes: #1150328, CVE-2026-107181).
   * Rebuild against RNNoise and activate noise cancellation in calls.
   * Upgrade Debhelper compatibility level to 14.
   * Update Standards-Version to 4.7.4.
   * Set dpkg build API level to 1.
Checksums-Sha1:
 e404d0c759ff7ddebef32bf421909dea14a65a40 2722 telegram-desktop_5.7.2+ds-6.dsc
 2e0a945e6812cf51ca5451abab01eae44c7f4ae9 34820 telegram-desktop_5.7.2+ds-6.debian.tar.xz
Checksums-Sha256:
 093f5d3923216c7bea2c3c4f7369c5ffdc99b61c64128dcf849d643589f1aa2e 2722 telegram-desktop_5.7.2+ds-6.dsc
 ee325a3b4160e0457fb6465a5a0b94114d87876a10d5349ae82d8c6bc2c86e76 34820 telegram-desktop_5.7.2+ds-6.debian.tar.xz
Files:
 c8fe5d114a106a56295df210ee3e1aa2 2722 net optional telegram-desktop_5.7.2+ds-6.dsc
 cd1b0599fadaba2c2e69c809aad901c8 34820 net optional telegram-desktop_5.7.2+ds-6.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iIYEARYKAC4WIQQRm7llN8yxifaG60cF2qh9JI3wlQUCauOWrBAcZ3VyaWV2LW5z
QHlhLnJ1AAoJEAXaqH0kjfCV36QA/ifM3CPlRmmYNc42D02dW/E9als2eKPN+p2c
pePV58A4AP4w8Lf36o8Y7MvO3OWsYSXiX4709rbLszHLRt2IP+yrAw==
=PFQ+
-----END PGP SIGNATURE-----