CVE-2024-33905: Morethanwords Tweb

Medium severity, CVSS 4.6. EPSS: 0.9% chance of exploitation in the next 30 days.

In Telegram WebK before 2.0.0 (488), a crafted Mini Web App allows XSS via the postMessage web_app_open_link event type.

Affected products

• Morethanwords Tweb

Published 2024-04-29. Last modified 2026-06-17.