Description
telegram-search contains a stored cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript in victims' browsers by sending crafted messages containing unsanitized HTML to a shared Telegram group. The highlightKeyword function in MessageList.vue passes raw message content directly to v-html without HTML escaping or sanitization, enabling stored, cross-user, zero-click execution of injected payloads such as image onerror handlers when victims browse or search messages.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
GramSearch telegram-search
Default version status: affected
0 to ≤ 1.2.8affected
References
- https://github.com/GramSearch/telegram-search ↗
- https://github.com/GramSearch/telegram-search/issues/653 ↗
- https://github.com/groupultra/telegram-search/commit/54f6adced844ce9990228d75e31348bfed934e05 ↗
- https://github.com/GramSearch/telegram-search/pull/654 ↗
- https://www.vulncheck.com/advisories/telegram-search-stored-xss-via-v-html-in-messagelist-vue ↗