A stored cross-site scripting vulnerability in GramSearch telegram-search could allow authenticated attackers to execute malicious scripts in the browsers of other users.

This vulnerability is a stored cross-site scripting flaw caused by improper neutralization of input in message handling. The vulnerability requires low privileges (authenticated) and user interaction to trigger the execution of arbitrary JavaScript.

The ability to execute arbitrary scripts in a victim's browser poses a significant risk to data confidentiality and session integrity. Successful exploitation could lead to session hijacking, unauthorized actions performed on behalf of the user, or the exfiltration of sensitive information, justifying the high CVSS score of 8.7.

Immediate Action: Monitor the vendor repository for the release of a security patch and apply it immediately upon availability.

Proactive Monitoring: Review application logs for unusual message content or suspicious HTML tags being processed within Telegram group communications.

Compensating Controls: Implement or tune Content Security Policy (CSP) headers to restrict the execution of inline scripts and unauthorized external resources within the application interface.

Public Exploit Available: false

Given the high severity of this XSS vulnerability, administrators should prioritize the identification of affected instances. Until a formal patch is released, users should exercise extreme caution when interacting with message content from untrusted sources, and security teams should enforce strict CSP headers to mitigate potential script execution.