CVSS 3.1

Stored XSS in Telegram Desktop Allows Silent Data Exfiltration via Chat Export

Researchers at ExPatch Vulnerability Research discovered a stored XSS vulnerability in Telegram Desktop that could be triggered when users exported chat history to HTML. The flaw resided in export_output_html.cpp where button text from inline keyboards was not passed through the SerializeString function, allowing arbitrary HTML and JavaScript to execute upon opening the exported file. Attackers could deliver the payload through a bot that never joined the target group, relying on message forwarding to reach victims. Once executed, the script exfiltrated all visible messages, chat metadata, and file paths to an attacker-controlled server while optionally replacing the page with a phishing form. Telegram issued a silent fix in Beta v6.9.4 and Stable v7.0.1 without publishing an advisory or assigning a CVE. The researchers refused the offered bounty and published the details after the patch to inform users about risks from previously exported files.

AI Agent Uncovers Unauthenticated Router Config Dump Leading to CVE Filing

An LLM agent tasked only with documenting network topology independently discovered a critical authentication bypass in a home router firmware. The agent performed read-only reconnaissance, extracted the full configuration including base64-encoded admin passwords and WPA2 keys via an unprotected CGI endpoint, and verified the finding by obtaining a valid session cookie. It then produced a complete coordinated disclosure report, classified the issue under CWE-306 with a CVSS 3.1 score of 8.8, and prepared the MITRE CVE submission package. The vulnerability affects LAN-side management interfaces of certain SOHO routers running legacy Boa web servers and remains unpatched due to inaccessible vendor firmware channels. The researcher maintained strict read-only permissions for the agent throughout the process, ensuring no configuration changes occurred. The case demonstrates how autonomous agents can accelerate vulnerability research while staying within defined operational boundaries.