PT-2026-107506

Name of the Vulnerable Software and Affected Versions Telegram Desktop versions prior to 7.2.9 Description An IPC record-separator injection flaw exists in Core::Sandbox due to the failure to escape semicolons used as command separators when passing tg:// links to a running instance over a local...

CVE-2026-107181: Improper Neutralization of Record Delimiters

Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including...

tg-autoposter (>=3.2.0, <=3.4.0b2) potentially affected by CVE-2026-92164 via streamlink (4.3.0)

streamlink PYPI version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on streamlink and may be impacted: - tg-autoposter =3.2.0, =3.4.0b2 Source cves: CVE-2026-92164 Source advisory: OSV:PYSEC-2026-4172...

offstream (>=1.0.0, <=1.0.2), tg-autoposter (>=2.4.0, <=2.4.1) potentially affected by CVE-2026-92164 via streamlink (3.0.3)

streamlink PYPI version 3.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on streamlink and may be impacted: - offstream =1.0.0, =2.4.0, =2.4.1 Source cves: CVE-2026-92164 Source advisory: OSV:PYSEC-2026-4172...

tg-autoposter (2.1.0) potentially affected by CVE-2026-92164 via streamlink (1.5.0)

streamlink PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on streamlink and may be impacted: - tg-autoposter 2.1.0 Source cves: CVE-2026-92164 Source advisory: OSV:PYSEC-2026-4172...

tg-autoposter (2.4.3) potentially affected by CVE-2026-92164 via streamlink (4.0.0)

streamlink PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on streamlink and may be impacted: - tg-autoposter 2.4.3 Source cves: CVE-2026-92164 Source advisory: OSV:PYSEC-2026-4172...

tg-autoposter (2.4.4) potentially affected by CVE-2026-92164 via streamlink (4.0.1)

streamlink PYPI version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on streamlink and may be impacted: - tg-autoposter 2.4.4 Source cves: CVE-2026-92164 Source advisory: OSV:PYSEC-2026-4172...

mlbv (>=0.0.18, <=0.0.19), streamlinkutils (>=0.0.1, <=0.0.2) +1 more potentially affected by CVE-2026-92164 via streamlink (2.4.0)

streamlink PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on streamlink and may be impacted: - mlbv =0.0.18, =0.0.1, =0.0.2 - tg-autoposter 2.3.0 Source cves: CVE-2026-92164 Source advisory: OSV:PYSEC-2026-4172...

tg-autoposter (2.2.0) potentially affected by CVE-2026-92164 via streamlink (2.1.2)

streamlink PYPI version 2.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on streamlink and may be impacted: - tg-autoposter 2.2.0 Source cves: CVE-2026-92164 Source advisory: OSV:PYSEC-2026-4172...

tg-autoposter (2.4.2) potentially affected by CVE-2026-92164 via streamlink (3.2.0)

streamlink PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on streamlink and may be impacted: - tg-autoposter 2.4.2 Source cves: CVE-2026-92164 Source advisory: OSV:PYSEC-2026-4172...

tg-autoposter (3.4.0) potentially affected by CVE-2026-92164 via streamlink (5.1.2)

streamlink PYPI version 5.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on streamlink and may be impacted: - tg-autoposter 3.4.0 Source cves: CVE-2026-92164 Source advisory: OSV:PYSEC-2026-4172...

gridplayer (>=0.4.0, <=0.4.3), tg-autoposter (>=3.1.1, <=3.1.2) potentially affected by CVE-2026-92164 via streamlink (4.2.0)

streamlink PYPI version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on streamlink and may be impacted: - gridplayer =0.4.0, =3.1.1, =3.1.2 Source cves: CVE-2026-92164 Source advisory: OSV:PYSEC-2026-4172...

gridplayer (0.3.0), tg-autoposter (>=3.0.0, <=3.1.0) potentially affected by CVE-2026-92164 via streamlink (4.1.0)

streamlink PYPI version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on streamlink and may be impacted: - gridplayer 0.3.0 - tg-autoposter =3.0.0, =3.1.0 Source cves: CVE-2026-92164 Source advisory: OSV:PYSEC-2026-4172...

agl-ocr-reader (1.1.1), app-ocr (>=0.0.1, <=1.2.14) +7 more potentially affected by CVE-2026-64847 via anyio (3.7.0)

anyio PYPI version 3.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - agl-ocr-reader 1.1.1 - app-ocr =0.0.1, =0.1.0, =0.0.1, =0.1.0, =1.2.0 - yt-fts 0.1.6 Source cves: CVE-2026-64847 Source advisory: OSV:PYSEC-2026-4024...

tg-autoposter (>=3.2.0, <=3.4.0b2) potentially affected by CVE-2026-92164 via streamlink (4.3.0)

streamlink PYPI version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on streamlink and may be impacted: - tg-autoposter =3.2.0, =3.4.0b2 Source cves: CVE-2026-92164 Source advisory: OSV:GHSA-VF2X-4V53-PM7V...

offstream (>=1.0.0, <=1.0.2), tg-autoposter (>=2.4.0, <=2.4.1) potentially affected by CVE-2026-92164 via streamlink (3.0.3)

streamlink PYPI version 3.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on streamlink and may be impacted: - offstream =1.0.0, =2.4.0, =2.4.1 Source cves: CVE-2026-92164 Source advisory: OSV:GHSA-VF2X-4V53-PM7V...

gridplayer (>=0.4.0, <=0.4.3), tg-autoposter (>=3.1.1, <=3.1.2) potentially affected by CVE-2026-92164 via streamlink (4.2.0)

streamlink PYPI version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on streamlink and may be impacted: - gridplayer =0.4.0, =3.1.1, =3.1.2 Source cves: CVE-2026-92164 Source advisory: OSV:GHSA-VF2X-4V53-PM7V...

tg-autoposter (2.4.4) potentially affected by CVE-2026-92164 via streamlink (4.0.1)

streamlink PYPI version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on streamlink and may be impacted: - tg-autoposter 2.4.4 Source cves: CVE-2026-92164 Source advisory: OSV:GHSA-VF2X-4V53-PM7V...

tg-autoposter (2.4.2) potentially affected by CVE-2026-92164 via streamlink (3.2.0)

streamlink PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on streamlink and may be impacted: - tg-autoposter 2.4.2 Source cves: CVE-2026-92164 Source advisory: OSV:GHSA-VF2X-4V53-PM7V...

gridplayer (0.3.0), tg-autoposter (>=3.0.0, <=3.1.0) potentially affected by CVE-2026-92164 via streamlink (4.1.0)

streamlink PYPI version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on streamlink and may be impacted: - gridplayer 0.3.0 - tg-autoposter =3.0.0, =3.1.0 Source cves: CVE-2026-92164 Source advisory: OSV:GHSA-VF2X-4V53-PM7V...