Stored XSS in telegram-search via MessageList.vue

CVE-2026-73031 identifies a critical stored cross-site scripting (XSS) vulnerability within the telegram-search application. The flaw originates in the MessageList.vue component, specifically within the highlightKeyword function, which processes and renders message content using the Vue.js v-html directive without performing adequate HTML escaping or sanitization. This oversight permits an attacker to inject arbitrary HTML and JavaScript payloads into messages within a shared Telegram group. Because the application processes these messages for searching and viewing, the injected code is stored persistently and executes in the context of any user who views or performs a search operation that includes the malicious message. This is effectively a zero-click execution vector that poses a significant risk for session hijacking or unauthorized actions performed in the victim's browser session.

Impact

Successful exploitation allows remote attackers to execute arbitrary JavaScript in the browsers of legitimate users. This can lead to the exfiltration of session cookies, sensitive user data, or unauthorized actions performed on behalf of the victim. Given the nature of stored XSS in search and message-viewing components, any user interacting with the compromised group or search results is vulnerable, potentially affecting the entire user base of the affected telegram-search deployment.

Recommendation

Prioritize updating the telegram-search application to the latest version that implements proper HTML sanitization for the highlightKeyword function. Audit the codebase to ensure all instances using the v-html directive are coupled with a robust sanitization library like DOMPurify before rendering user-supplied content. Implement a Content Security Policy (CSP) that restricts script execution to trusted sources to mitigate the impact of potential XSS vulnerabilities.