Threats affecting pkg:github/telegramdesktop/tdesktop

Telegram Desktop versions prior to 7.2.9 contain an IPC record-separator injection vulnerability in the Core::Sandbox component. This flaw allows remote attackers to craft tg:// links with unescaped semicolons to inject OPEN: records. Exploitation can lead to attackers uploading local files, including sensitive tdata session keys, to attacker-controlled channels, potentially resulting in account takeover.