[SECURITY] HIGH: HTML injection in Telegram messages #5

New Issue

shoko · 2026-03-25T10:38:06+01:00

shoko commented

2026-03-25 10:38:06 +01:00

Severity: HIGH

Event titles from Polymarket API are inserted directly into Telegram messages with parse_mode=HTML without escaping. Characters like <, >, & are not escaped.

Location

scripts/browse.py lines 614-661 (send_to_telegram())

Attack Scenario

Polymarket (or attacker who compromises data) includes title like <script>alert('XSS')</script>
The bot sends this to Telegram
Telegram renders the HTML (limited XSS risk but malformed HTML can cause issues)

Recommended Fix

import html

def escape_html(text):
    return (text
        .replace("&", "&amp;")
        .replace("<", "&lt;")
        .replace(">", "&gt;")
        .replace('"', "&quot;"))

title_escaped = escape_html(title_clean)
lines.append(f"<b>{i}.</b> <a href=\"{url}\">{title_escaped}</a>")

Reference

See reviews/2026-03-25.md Section 6.3

## Severity: HIGH Event titles from Polymarket API are inserted directly into Telegram messages with `parse_mode=HTML` without escaping. Characters like `<`, `>`, `&` are not escaped. ## Location `scripts/browse.py` lines 614-661 (`send_to_telegram()`) ## Attack Scenario 1. Polymarket (or attacker who compromises data) includes title like `<script>alert('XSS')</script>` 2. The bot sends this to Telegram 3. Telegram renders the HTML (limited XSS risk but malformed HTML can cause issues) ## Recommended Fix ```python import html def escape_html(text): return (text .replace("&", "&") .replace("<", "<") .replace(">", ">") .replace('"', """)) title_escaped = escape_html(title_clean) lines.append(f"<b>{i}.</b> <a href=\"{url}\">{title_escaped}</a>") ``` ## Reference See `reviews/2026-03-25.md` Section 6.3

shoko added the high security labels 2026-03-25 10:38:06 +01:00

shoko referenced this issue

2026-03-25 10:40:34 +01:00

[SECURITY] polymarket-browse: Security Audit Tracking (2026-03-25) #3

shoko referenced this issue from a commit

2026-03-25 12:42:51 +01:00

Fix #5: HTML injection in Telegram messages

shoko referenced a pull request that will close this issue

2026-03-25 12:43:02 +01:00

Fix #5: HTML injection in Telegram messages #20

shoko closed this issue

2026-03-25 13:13:52 +01:00