[Yu Xian Warns of Security Risks in Telegram's New Feature: QuickJS Execution Engine May Have Sandbox Escape Vulnerability] Odaily Planet Daily reports that Yu Xian, founder of SlowMist, has warned that the new version of Telegram supports embedding interactive applications directly into chat messages. This feature uses QuickJS to execute JavaScript, which may increase the risk of malicious code attacks. Users are advised to upgrade with caution. Telegram officially introduced this feature in its Bot API 10.4, released on November 9th. Although the official QuickJS sandbox and network access restrictions are provided, recent security research has discovered that the execution engine has a remote code execution vulnerability that could potentially bypass the sandbox isolation.