This vulnerability (CVE-2026-93514) in Notification for Telegram (<= 3.5.2) is an improper neutralization of input during web page generation, classified as CWE-79 (Cross-site Scripting). It allows unauthenticated attackers to inject malicious scripts, potentially leading to cross-site scripting attacks that affect confidentiality, integrity, and availability. The CVSS v3.1 base score is 7.1 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and partial impact on confidentiality, integrity, and availability.

Successful exploitation can lead to partial loss of confidentiality, integrity, and availability of the affected system. Because the vulnerability is unauthenticated and remotely exploitable, it poses a significant risk to users of Notification for Telegram up to version 3.5.2. However, no known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution and consider limiting exposure of the affected application. No vendor advisory or patch links are currently provided.