Low Severity
CVE-2026-107181
Published: Oct 30, 2026
CVE-2026-107181 Proof Of Concept for telegram Desktop account take over in windows
<div align="center">
# `telegram-cve-2026-107181-poc`
### Telegram Desktop · IPC Injection Research
**A research PoC examining unsafe deep-link handling and local-file exposure risks.**
<br>
<br>
> **Research scope:** controlled, authorized testing only. The current instruction-file defaults refer to sensitive Telegram session artifacts. Do not test against a real account or another person's device.
</div>
---
## Contents
- [At a glance](#-at-a-glance)
- [Why this is not conventional RCE](#-why-this-is-not-conventional-rce)
- [How the vulnerability works](#-how-the-vulnerability-works)
- [Repository structure](#-repository-structure)
- [Requirements](#-requirements)
- [Install and inspect](#-install-and-inspect)
- [Instruction files](#-instruction-files)
- [Project scripts](#-project-scripts)
- [Testing and research notes](#-testing-and-research-notes)
- [Safety checklist](#-safety-checklist)
- [References](#-references)
- [License](#-license)
---
## 🔎 At a glance
| Field | Details |
|---|---|
| Identifier | [CVE-2026-107181](https://www.cve.org/CVERecord?id=CVE-2026-107181) |
| Product | Telegram Desktop |
| Technical class | IPC record-separator injection |
| Reported impact | Arbitrary local-file read/exfiltration; potential account takeover |
| User interaction | A user must open a crafted link |
| Affected versions reported by the research | Through 7.2.8 |
| Fixed version reported by the research | 7.2.9 |
| Language | JavaScript / Node.js |
| Runtime | Node.js 18+ |
> Verify affected-version ranges and CVE status against the authoritative record