(URGENT) Lemmy has an XSS vulnerability in the sidebar - sh.itjust.works
sh.itjust.works
lemmy.world is a victim of an XSS attack right now and the hacker simply injected a JavaScript redirection into the sidebar. It appears the Lemmy backend does not escape HTML in the main sidebar. Not sure if this is also true for community sidebars. [https://sh.itjust.works/pictrs/image/707c0f16-3d5c-4888-b865-34228d968ee6.png]

I don't really understand what any of this means, maybe someone can explain it for me, I'm a little nervous to keep browsing on lemmygrad if this can apparently be exploited thru comments and posts or something?

there's disagreement about what's happening several comments down so an explanation would be appreciated

    • forcequit [she/her]
      ·
      1 year ago

      Yeah I just saw that. Wonder what the issue is/what the commonality between accounts is

    • BigLadKarlLiebknecht [he/him, comrade/them]
      ·
      1 year ago

      Fuck. I don’t think I’ve ever browsed lemmygrad, let alone posted there.

      Is there anything I should be doing? I’ve tried resetting my password but the form seems broken. I guess this might be a sign it’s time for me to retire this account? sadness

      • FuckyWucky [none/use name]
        ·
        1 year ago

        Change password and log out until it's fixed. Once logged out the cookie is no longer valid.

          • BoarAvoir [they/them]A
            ·
            1 year ago

            Password reset is working, but the UX is a little confusing to say the least.

            New Password = The new password Verify Password = Also the new password Old Password = current password

            Easy to mix up when there is no error message, just a spinner.

      • BoarAvoir [they/them]A
        ·
        1 year ago

        you should no longer need to change your password. Update post here: https://hexbear.net/post/277570

        Nothing to do with lemmygrad