CVE-2026-73031
telegram-search contains a stored cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript in victims' browsers by sendi…
Impact
telegram-search contains a stored cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript in victims' browsers by sending crafted messages containing unsanitized HTML to a shared Telegram group. The highlightKeyword function in MessageList.vue passes raw message content directly to v-html without HTML escaping or sanitization, enabling stored, cross-user, zero-click execution of injected payloads such as image onerror handlers when victims browse or search messages.
Affected packages
This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/GramSearch/telegram-search
- https://github.com/GramSearch/telegram-search/issues/653
- https://github.com/GramSearch/telegram-search/pull/654
- https://github.com/groupultra/telegram-search/commit/54f6adced844ce9990228d75e31348bfed934e05
- https://www.vulncheck.com/advisories/telegram-search-stored-xss-via-v-html-in-messagelist-vue