(URGENT) Lemmy has an XSS vulnerability in the sidebar (slrpnk.net)

submitted 1 year ago by j_roby@slrpnk.net to c/meta@slrpnk.net

3 comments fedilink hide all child comments

cross-posted from: https://sh.itjust.works/post/923025

lemmy.world is a victim of an XSS attack right now and the hacker simply injected a JavaScript redirection into the sidebar.

It appears the Lemmy backend does not escape HTML in the main sidebar. Not sure if this is also true for community sidebars.