CVE-2026-73031

Received Received - Intake

Stored XSS in Telegram Search via Unsanitized Message Content

Publication date: 2026-08-11

Last updated on: 2026-08-14

Assigner: VulnCheck

Description

telegram-search contains a stored cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript in victims' browsers by sending crafted messages containing unsanitized HTML to a shared Telegram group. The highlightKeyword function in MessageList.vue passes raw message content directly to v-html without HTML escaping or sanitization, enabling stored, cross-user, zero-click execution of injected payloads such as image onerror handlers when victims browse or search messages.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-14

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-73031

EUVD

EUVD-2026-56889

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the telegram-search application. It allows attackers to inject malicious JavaScript into shared Telegram groups by sending crafted messages with unsanitized HTML. The highlightKeyword function in MessageList.vue passes raw message content to v-html without HTML escaping, enabling automatic execution of injected payloads when victims browse or search messages.

Detection Guidance

To detect this vulnerability, inspect the telegram-search application for versions up to and including 1.2.8. Check the MessageList.vue file for the highlightKeyword function that uses v-html without HTML escaping. Look for unsanitized HTML input in shared Telegram groups that could execute malicious JavaScript payloads.

Impact Analysis

This vulnerability enables zero-click attacks where malicious scripts execute automatically in victims' browsers without any user interaction. Attackers could steal session cookies, perform actions on behalf of users, or redirect to phishing sites. Users viewing or searching messages in shared groups are at risk of having their accounts compromised or sensitive data exposed.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate GDPR's data protection principles (e.g., integrity and confidentiality) and HIPAA's security requirements for protected health information. Stored XSS attacks may enable attackers to exfiltrate personal or health data, triggering non-compliance with these regulations.

Mitigation Strategies

Update telegram-search to a version that includes the fix in commit 54f6adc. Ensure the highlightKeyword function sanitizes input using an HTML escaping function before passing content to v-html. Remove or restrict access to vulnerable versions until patched.

Hi! I’m here to help you understand CVE-2026-73031. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70