(URGENT) Lemmy has an XSS vulnerability in the sidebar - sh.itjust.works
sh.itjust.works
lemmy.world is a victim of an XSS attack right now and the hacker simply injected a JavaScript redirection into the sidebar. It appears the Lemmy backend does not escape HTML in the main sidebar. Not sure if this is also true for community sidebars. [https://sh.itjust.works/pictrs/image/707c0f16-3d5c-4888-b865-34228d968ee6.png]

I don't really understand what any of this means, maybe someone can explain it for me, I'm a little nervous to keep browsing on lemmygrad if this can apparently be exploited thru comments and posts or something?

there's disagreement about what's happening several comments down so an explanation would be appreciated

  • FuckyWucky [none/use name]
    ·
    1 year ago

    hmm why not disable comment/posts until its fixed? would be the safer option. i assume the 'hacker' is stealing cookies. so even 2fa won't help.

    • ImOnADiet
      ·
      1 year ago

      this is an awkward time of day, just past when most Americans are going to sleep and right as europeans get ready/are going to work