CVE-2026-73031

This is not a zero-click vulnerability in the sense that victims must somehow be tricked — it's a trust boundary inversion where every message in a shared Telegram group is a potential payload that fires passively during normal tool usage. The search and message browsing functionality is the intended use case; viewing and searching messages automatically triggers highlightKeyword on ALL messages in the view, including malicious ones. The attacker doesn't need a click because the victim's workflow (searching for legitimate terms) is the trigger. The core failure: the tool renders Telegram messages as trusted HTML via v-html, treating content from a "legitimate platform" as inherently safe. This is architecturally deterministic rather than a simple oversight — the developer must choose between sanitization (which breaks rich formatting in search highlights) or trusting Telegram. Without an architectural forcing function that makes sanitization the path of least resistance, most developers choose trust. What to check: Audit every display path in the codebase that uses v-html or similar HTML-rendering directives on external input — not just the highlighted MessageList.vue component. The 'architecturally inevitable' framing suggests this pattern likely exists elsewhere. Additionally, consider every historical message in public Telegram groups indexed by this tool as potentially malicious — attackers may have already planted payloads waiting for disclosure. The exposure window compounds over time: unpatched, more groups accumulate more payloads, and more users inadvertently activate more malicious content through normal searches. The severity (CVSS 8.7) reflects zero-click, broadcast-capable, passively-triggered execution with no meaningful patch-priority distinction between urgent and convenient fixes. The vulnerability class — rendering untrusted HTML from external sources in message aggregation tools — has recurred across hundreds of CVEs, indicating a systemic pattern rather than isolated developer error.

Reviewed through automated stages and approved by a human before publication.