An inline keyboard button is a Telegram bot interface element that adds clickable actions directly to a message. Unlike a plain text message, it can include buttons that open a link, send callback data to the bot, or trigger another action when the user taps it. Because the button is part of the message content, it is often treated as trusted UI by the client and by export or rendering features.
In cyber security, inline keyboard buttons matter because bot-generated fields can become attack input if they are copied into HTML, logs, or other output without proper escaping. In a stored XSS chain, a malicious button label or action field can help turn a saved chat into active web content when an export is opened. Defenders should treat every bot-controlled message component as untrusted data and ensure it is encoded before rendering.