Threats tagged 'ghsa-2h6w-ccjh-5jhr'

Telegram Desktop versions before 7.2.9 have an IPC record-separator injection vulnerability in the Core::Sandbox component. This flaw allows remote attackers to craft tg:// links with unescaped semicolons to inject OPEN: records. Exploitation can lead to uploading local files, including sensitive tdata session keys, to an attacker-controlled channel, potentially resulting in account takeover.