The GramSearch telegram-search application contains a stored cross-site scripting vulnerability identified as CVE-2026-73031. The issue is due to improper neutralization of input during web page generation. Specifically, the highlightKeyword function in the MessageList.vue component directly passes raw message content to the Vue.js v-html directive without HTML escaping or sanitization. This flaw allows remote attackers to inject malicious JavaScript payloads into messages sent to a shared Telegram group. When other users browse or search these messages, the injected scripts execute automatically (zero-click), potentially compromising user browsers. The vulnerability has a CVSS 4.0 base score of 8.2, indicating high severity. No patch or official remediation guidance is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows remote attackers to execute arbitrary JavaScript in the context of victims' browsers without user interaction beyond viewing or searching messages. This can lead to session hijacking, theft of sensitive information, or other malicious actions within the victim's browser context. The vulnerability affects all users who access the vulnerable telegram-search interface and view crafted messages in shared Telegram groups.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when browsing or searching messages in shared Telegram groups using the vulnerable telegram-search application. Avoid interacting with untrusted or suspicious messages that may contain malicious HTML content.