Telegram Desktop through 2.0.1, Telegram through 6.0.1 for Android, and Telegram through 6.0.1 for iOS allow an IDN Homograph attack via Punycode in a public URL or a group chat invitation URL.
{
"versions": [
{
"introduced": "0"
},
{
"last_affected": "6.0.1"
},
{
"introduced": "0"
},
{
"last_affected": "6.0.1"
},
{
"introduced": "0"
},
{
"last_affected": "2.0.1"
}
]
}